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USE AND MISUSE OF SOCIAL SECURITY 
NUMBERS 


THURSDAY, JULY 10, 2003 

U.S. House of Representatives, 

Committee on Ways and Means, 
Subcommittee on Social Security, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 1:18 p.m., in room 
B-318, Rayburn House Office Building, Hon. E. Clay Shaw, Jr. 
(Chairman of the Subcommittee) presiding. 

[The advisory and revised advisory announcing the hearing fol- 
low:] 


( 1 ) 
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ADVISORY 

FROM THE COMMITTEE ON WAYS AND MEANS 

SUBCOMMITTEE ON SOCIAL SECURITY 

FOR IMMEDIATE RELEASE CONTACT: (202) 225-1721 

July 02, 2003 

SS-3 


Shaw Announces Hearing on 
Use and Misuse of Social Security Numbers 

Congressman E. Clay Shaw, Jr. (R-FL), Chairman, Subcommittee on Social Secu- 
rity of the Committee on Ways and Means, today announced that the Subcommittee 
will hold a hearing on both the use and misuse of Social Security numbers. The 

hearing will take place on Thursday, July 10, 2003, in room B-318 Rayburn 
House Office Building, beginning at 10:00 a.m. 

In view of the limited time available to hear witnesses, oral testimony at this 
hearing will be from invited witnesses only. However, any individual or organization 
not scheduled for an oral appearance may submit a written statement for consider- 
ation by the Committee and for inclusion in the printed record of the hearing. 

BACKGROUND : 

The Social Security number (SSN) was originally created in 1936 to track workers’ 
earnings for benefit purposes. Use of the SSN by both government agencies and the 
private sector has exploded over the decades as automation of record keeping and 
other business processes encouraged use of this simple, unique number that vir- 
tually every American possesses. As a result, many have called it a de facto national 
identifier, though it was never intended as such. 

Today, even the most routine transactions may involve sharing of SSNs. Banks, 
schools, stores, and other businesses often use SSNs as account numbers. The SSN 
is used to help compile information from many different public and private sources 
for use in everything from tracking down criminals to issuing credit. Additionally, 
SSNs are easily found on display to the general public on employee badges, licenses, 
or court documents. In short, SSNs are the key to an individual’s financial and 
other personal information, but their confidentiality is not well protected. 

Use of the SSN as a personal identifier has produced some beneficial results for 
the public, including reduction in government waste from program fraud, enhanced 
collection of child support, and better law enforcement. Unfortunately, widespread 
utilization and public exposure of SSNs have also made them an invaluable tool for 
identity thieves. According to the Identity Theft Resource Center, an estimated 
700,000 people of all ages, races, and economic backgrounds were victims of identity 
theft last year. The harm inflicted can be devastating difficulty obtaining credit, 
harassment by debt collectors, or even arrest because of the crimes of the identity 
thief. Worse yet, according to the Federal Bureau of Investigation, terrorists have 
utilized Social Security number fraud and identity theft to obtain employment, ac- 
cess secure locations, and finance their activities all of which threaten our national 
security. 

The Social Security Administration (SSA) serves as the front line of defense in 
ensuring SSN integrity. It is responsible for accurately assigning SSNs and ensur- 
ing the wages earned and Social Security benefits claimed on that number are only 
those of the number holder. The SSA’s Inspector General (IG) has long criticized the 
agency’s failure to verify the authenticity of identification documents, and last year 
SSA began verifying supporting immigration records before issuing SSN cards. In 
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addition, despite the agencies efforts to reduce wage-reporting discrepancies — in- 
cluding outreach to employers 2 to 3 percent of wage items, equaling about $50 bil- 
lion, will remain unmatched after wage processing is complete, according to the 
SSA. 

In announcing the hearing, Chairman Shaw stated: “The Social Security number 
was originally intended to ensure American’s hard-earned wages were properly cred- 
ited to their record, so that they could receive their due benefits at retirement. 
Today, however, use and misuse of these numbers is rampant. The Federal Govern- 
ment requires the use of Social Security numbers and, therefore, has the responsi- 
bility to ensure they are assigned accurately, exchanged only when necessary, and 
protected from indiscriminant disclosure. We must stem the tide of attacks on Social 
Security number privacy. As in previous Congresses, I remain committed to pur- 
suing bipartisan legislation to protect the privacy and integrity of Social Security 
numbers.” 

FOCUS OF THE HEARING : 

The Subcommittee will examine the widespread use and misuse of the SSN in the 
public and private sectors and the effects of such use and misuse, as well as the 
integrity of the SSA’s Social Security number issuance and wage crediting process. 

DETAILS FOR SUBMISSION OF WRITTEN COMMENTS : 

Please Note: Due to the change in House mail policy, any person or organization 
wishing to submit a written statement for the printed record of the hearing should 
send it electronically to hearingclerks.waysandmeans@mail.house.gov, along with a 
fax copy to (202) 225-2610, by the close of business, Thursday, July 24, 2003. Those 
filing written statements who wish to have their statements distributed to the press 
and interested public at the hearing should deliver their 200 copies to the Sub- 
committee on Social Security in room B-316 Rayburn House Office Building, in an 
open and searchable package 48 hours before the hearing. The U.S. Capitol Police 
will refuse sealed-packaged deliveries to all House Office Buildings. 

FORMATTING REQUIREMENTS: 


Each statement presented for printing to the Committee by a witness, any written statement 
or exhibit submitted for the printed record or any written comments in response to a request 
for written comments must conform to the guidelines listed below. Any statement or exhibit not 
in compliance with these guidelines will not be printed, but will be maintained in the Committee 
files for review and use by the Committee. 

1. Due to the change in House mail policy, all statements and any accompanying exhibits for 
printing must be submitted electronically to hearingclerks.waysandineans@mail.house.gov, along 
with a fax copy to (202) 225-2610, in Word Perfect or MS Word format and MUST NOT exceed 
a total of 10 pages including attachments. Witnesses are advised that the Committee will rely 
on electronic submissions for printing the official hearing record. 

2. Copies of whole documents submitted as exhibit material will not be accepted for printing. 
Instead, exhibit material should be referenced and quoted or paraphrased. All exhibit material 
not meeting these specifications will be maintained in the Committee files for review and use 
by the Committee. 

3. Any statements must include a list of all clients, persons, or organizations on whose behalf 
the witness appears. A supplemental sheet must accompany each statement listing the name, 
company, address, telephone and fax numbers of each witness. 

Note: All Committee advisories and news releases are available on the World 
Wide Web at http://waysandmeans.house.gov. 

The Committee seeks to make its facilities accessible to persons with disabilities. 
If you are in need of special accommodations, please call 202-225-1721 or 202-226- 
3411 TTD/TTY in advance of the event (four business days notice is requested). 
Questions with regard to special accommodation needs in general (including avail- 
ability of Committee materials in alternative formats) may be directed to the Com- 
mittee as noted above. 
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* * * NOTICE— CHANGE IN TIME * * * 

ADVISORY 

FROM THE COMMITTEE ON WAYS AND MEANS 

SUBCOMMITTEE ON SOCIAL SECURITY 

FOR IMMEDIATE RELEASE CONTACT: (202) 225-1721 

July 08, 2003 
SS-3 Revised 


Change in Time for Hearing on 
Use and Misuse of Social Security Numbers 

Congressman E. Clay Shaw, Jr. (R-FL), Chairman, Subcommittee on Social Secu- 
rity of the Committee on Ways and Means, today announced that the Subcommittee 
hearing on use and misuse of Social Security numbers, previously scheduled for 
Thursday, July 10, 2003, at 10:00 a.m., in room B-318 Rayburn House Office Build- 
ing, will now be held at 1:00 p.m. or immediately following the completion 
of the full Committee informal mark up of the Singapore and Chilean Free 
Trade Agreements. 

All other details for the hearing remain the same. (See Subcommittee Advisory 
No. SS-3, dated July 3, 2003). 


Chairman SHAW. I am sorry. We are a few minutes late start- 
ing, but we had a busy morning with our Committee. Good after- 
noon. Today, the Subcommittee will examine the use and misuse 
of Social Security Numbers (SSNs). Using the SSN as a personal 
identifier has proven both a blessing and a curse. On one hand, the 
public is served when governmental agencies can use the number 
in matching information from other sources to reduce program 
waste, fraud and abuse, or when law enforcement agencies employ 
SSNs to help track down criminals or deadbeat dads. On the other 
hand, easy access to these numbers and their widespread use has 
provided a new tool for identity thieves. Worse yet, terrorists use 
SSN fraud and identity theft to assimilate themselves into our soci- 
ety, as did those responsible for the September 11th attacks. Iden- 
tity theft continues to threaten our national security. Identity theft 
is the fastest growing white collar crime, and no one is immune, 
but the public is increasingly recognizing the vulnerabilities of 
SSNs and is working to protect them. Businesses are taking steps 
on their own to move away from using SSNs and several States 
have passed legislation, including Texas just last week, to protect 
SSNs from public display. 

The Social Security Administration (SSA) serves as the front line 
of defense in ensuring the integrity of SSNs from the moment they 
are issued throughout the number holder’s lifetime and even after 
his or her death, a responsibility the SSA takes very seriously. It 
is also responsible for ensuring the wages earned and Social Secu- 
rity benefits claimed on that number are only those of the number 
holder. As our witnesses will tell us, while the agency has taken 
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steps to improve the number assignment process, there is still more 
to do to prevent people from fraudulently obtaining and using 
SSNs. However, protecting the privacy and accuracy of SSNs is not 
the SSA’s responsibility alone. Employers and individuals have a 
responsibility for submitting correct information to the SSA or cor- 
recting erroneous information. The Internal Revenue Service (IRS) 
has responsibility for imposing appropriate penalties on employers 
who submit erroneous wage reports to the SSA. The Bureau of Citi- 
zenship and Immigration Services must better coordinate with the 
SSA in verifying eligibility for a SSN and acting on information re- 
garding earnings reported to nonwork numbers. Lastly, every pub- 
lic agency that uses and shares SSNs has the responsibility to pro- 
tect their privacy. 

The Subcommittee has been working on a bipartisan basis to pro- 
tect the privacy of SSNs and prevent identity theft since the 106th 
Congress, when it first approved the Social Security Number Pri- 
vacy and Identity Theft Prevention Act of 2000 (H.R. 4857). In the 
107th Congress I, along with Ranking Member Matsui and 80 
other Members of Congress, reintroduced a similar bill. Mr. Klecz- 
ka, of our full Committee, has also been very active in this regard. 
Consideration of this legislation was rightly preempted by nec- 
essary congressional response to 9/11 attacks. In coming days, Mr. 
Matsui and I will again introduce bipartisan legislation to restrict 
the sale and public display of SSNs, establish penalties for viola- 
tions, limit dissemination of SSNs by credit reporting agencies, 
make it more difficult for businesses to deny services if a customer 
refuses to provide their SSN, and improve the integrity of the SSN 
assignment process. Congress must act this session to protect the 
very number it requires each of us to obtain and use throughout 
our lifetime. Providing for uses of SSNs that benefit the public 
while protecting these numbers from being used by criminals or 
even terrorists is a complex balancing act, as we found out in pre- 
vious Congresses. We can make significant progress toward this 
goal by ensuring SSNs are assigned accurately, exchanged only 
when necessary, and protected from indiscriminate disclosure. I 
look forward to hearing from each of our witnesses, and thank 
them in advance for sharing with us their experiences and their 
recommendations. I understand Mr. Matsui is otherwise engaged 
this afternoon, and he has asked Mr. Cardin to sit in for him. The 
gentleman from Maryland. 

[The opening statement of Chairman Shaw follows:] 

Opening Statement of The Honorable E. Clay Shaw, Jr., Chairman, and a 
Representative in Congress from the State of Florida 

Good afternoon. Today, the Subcommittee will examine the use and misuse of So- 
cial Security numbers. 

Using the Social Security number as a personal identifier has proved both a bless- 
ing and a curse. On one hand, the public is served when government agencies can 
use the number in matching information from other sources to reduce program 
waste, fraud and abuse, or when law enforcement agencies employ Social Security 
numbers to help track down criminals or deadbeat dads. On the other hand, easy 
access to these numbers and their widespread use has provided a new tool for iden- 
tity thieves. Worse yet, terrorists use Social Security number fraud and identity 
theft to assimilate themselves into our society, as did those responsible for the Sep- 
tember 11 th attacks. Identity theft continues to threaten our national security. 

Identity theft is the fastest growing white collar crime, and no one is immune. 
But the public is increasingly recognizing the vulnerabilities of Social Security num- 
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bers and is working to protect them. Businesses are taking steps on their own to 
move away from using Social Security numbers, and several States have passed leg- 
islation, including Texas just last week, to protect SSNs from public display. 

The Social Security Administration serves as the front line of defense in ensuring 
the integrity of Social Security numbers from the moment they are issued, through- 
out the number-holder’s lifetime, and even after his or her death — a responsibility 
the SSA takes very seriously. It is also responsible for ensuring the wages earned 
and Social Security benefits claimed on that number are only those of the number- 
holder. As our witnesses will tell us, while the agency has taken steps to improve 
the number assignment process, there is still more to do to prevent people from 
fraudulently obtaining and using Social Security numbers. 

However, protecting the privacy and the accuracy of Social Security numbers is 
not the Social Security Administration’s responsibility alone. Employers and individ- 
uals have a responsibility for submitting correct information to the Social Security 
Administration, or correcting erroneous information. The Internal Revenue Service 
has responsibility for imposing appropriate penalties on employers who submit erro- 
neous wage reports to the Social Security Administration. The Bureau of Citizenship 
and Immigration Services must better coordinate with the Social Security Adminis- 
tration in verifying eligibility for a Social Security number and acting on informa- 
tion regarding earnings reported to non-work numbers. Lastly, every public agency 
that uses and shares Social Security numbers has the responsibility to protect their 
privacy. 

This Subcommittee has been working on a bipartisan basis to protect the privacy 
of Social Security numbers and prevent identity theft since the 106 th Congress when 
it first approved the Social Security Number Privacy and Identity Theft Prevention 
Act of 2000. In the 107 th Congress, I, along with Ranking Member Matsui and 80 
other Members of Congress reintroduced a similar bill. Consideration of this legisla- 
tion was rightly preempted by necessary Congressional response to the September 
11th attacks. 

In coming days, Mr. Matsui and I will again introduce bipartisan legislation to 
restrict the sale and public display of Social Security numbers, establish penalties 
for violations, limit dissemination of Social Security numbers by credit reporting 
agencies, make it more difficult for businesses to deny services if a customer refuses 
to provide their Social Security number, and improve the integrity of the Social Se- 
curity number assignment process. Congress must act this session to protect the 
very number it requires each of us to obtain and use throughout our lifetime. 

Providing for uses of Social Security numbers that benefit the public while pro- 
tecting these numbers from being used by criminals, or even terrorists, is a complex 
balancing act. We can make significant progress toward this goal by ensuring Social 
Security numbers are assigned accurately, exchanged only when necessary, and pro- 
tected from indiscriminant disclosure. 

I look forward to hearing from each of our witnesses, and thank them in advance 
for sharing with us their experiences and their recommendations. 


Mr. CARDIN. Thank you, Chairman Shaw. Let me thank you for 
holding this hearing. I also want to thank you for your leadership 
on this very important issue. I also want to acknowledge Mr. Mat- 
sui and Mr. Kleczka for the work they have done on identity fraud 
and the use of SSNs. Mr. Chairman, it is noteworthy to point out 
this is our ninth hearing on this subject, and it is a commitment 
that we have to take action in this area. As you pointed out, iden- 
tity theft is considered one of the fastest growing crimes in the 
United States, with an average of an estimated 700,000 people 
being affected last year. It can ruin an individual’s good name and 
destroy their credit rating. It even has affected the credit ratings 
of their young children. While credit issuers have been willing to 
refund fraudulent charges, victims are still faced with the effects 
of poor credit, the time commitments of restoring their ratings with 
multiple credit bureaus and credit issuers and the fear and anxiety 
associated with knowing someone is using their personal informa- 
tion to charge goods and services. 
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As a result of identity theft, victims have been turned down for 
jobs, mortgages and other important extensions of credit. So, there- 
fore this is a very important subject, and we need to take action. 
As you pointed out, it even goes beyond the immediate problems 
of individuals that have found that the criminal elements, includ- 
ing terrorists, have used the identity of other people through SSNs 
in order to carry out their activities. We have a dilemma, the SSN 
is basically a national identifier. We have used it. We can’t guar- 
antee the confidentiality of that number, and therefore it can be 
used for identity theft. I am looking forward to the testimony from 
the U.S. General Accounting Office (GAO) and the Inspector Gen- 
eral, who have been extremely helpful to us in coming forward with 
suggestions on how we can protect the confidentiality or use of the 
SSNs and how we can protect against identity theft. The bottom 
line is we need to take action in this area. The Chairman has indi- 
cated that he will be filing legislation shortly with Mr. Matsui. I 
can assure you we want to move forward as quickly as possible in 
a bipartisan way in order to try to help our people against this 
growing element of crime. Thank you, Mr. Chairman. 

Chairman SHAW. Thank you, Mr. Cardin. I would like to just 
point out I think that we share jurisdiction with two other commit- 
tees with regard to this legislation. Our Committee has moved for- 
ward in the past but we need to bring the other committees along 
with us in order to have a complete comprehensive bill rather than 
just picking and choosing the small portions of which our Com- 
mittee has jurisdiction. Any other Members have an opening state- 
ment? The record will remain open. Without objection, they will be 
included in the transcript. On our first panel are two old friends 
of this Committee, Barbara Bovbjerg, who is the Director of Edu- 
cation, Workforce, and Income Security Issues from the GAO, and 
she is accompanied by Dan Bertoni, I believe that is the correct 
pronunciation, who is the Deputy Director. From the SSA, we have 
the Honorable James Huse, who is the Inspector General. As you 
all well know, we have your full statement which will be made a 
part of the record. We invite you to summarize as you see fit. Ms. 
Bovbjerg. 

STATEMENT OF BARBARA D. BOVBJERG, DIRECTOR, EDU- 
CATION, WORKFORCE, AND INCOME SECURITY ISSUES, U.S. 

GENERAL ACCOUNTING OFFICE; ACCOMPANIED BY DAN 

BERTONI, DEPUTY DIRECTOR 

Ms. BOVBJERG. Thank you, Mr. Chairman, and Members of the 
Subcommittee. I am pleased to be here again today — I don’t think 
it has been nine times for me, but it has been a number — to discuss 
issues associated with the integrity and use of the SSN. Although 
the SSN was originally created as a means to track workers’ earn- 
ings and their eligibility for Social Security benefits, today the 
number is used for many non-Social Security purposes in both the 
public and private sectors. The wide use of SSNs causes concern 
because these numbers are among the personal identifiers most 
often sought by identity thieves. Today, I will present results of our 
completed and ongoing work on a variety of issues associated with 
the SSN. I would like to focus first on public and private sector use 
of the SSN and then, second, on the role of the SSA in preventing 
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the proliferation of false identities. My testimony is based on a re- 
port we did for this Subcommittee on government uses of the SSN 
and on ongoing work that focuses on private sector uses and on 
SSA’s role in assigning SSNs and verifying them for others. I have 
so much material today that is relevant to this hearing and some 
visual aids to illustrate my points, I would ask to speak longer 
than the usual 5 minutes. I hope that will be acceptable to the Sub- 
committee. I will try not to prey on your good nature for very much 
longer. 

Let me speak first about public and private uses. We reported 
last year that Federal, State, and county agencies rely extensively 
on the SSN. Although government agencies told us of various steps 
they take to safeguard the SSNs they use, we found that key pro- 
tections are not uniformly in place at any level of government. We 
also found that some Federal agencies and many of the State and 
county agencies we surveyed, including courts in all the three lev- 
els of government, maintain public records that contain SSNs. Pub- 
lic records are documents routinely made available to the public for 
inspection such as marriage licenses or property transactions. For 
customer service reasons, some public officials told us they were 
considering making such records available on their websites. Be- 
cause such actions would create new opportunities for identity 
thieves to gather SSNs from public records on a broad scale, we are 
beginning work for this Subcommittee to examine the extent to 
which SSNs in public records are already accessible on the Inter- 
net. Although we are not far along enough in this work to report 
the results today, I can assure you that we have already found 
SSNs in several public websites. 

With regard to the private sector, we are finding that companies 
too are increasingly using SSNs, often collecting them from cus- 
tomers as a condition for providing service. For example, consumer 
reporting agencies (CRAs) build and maintain credit histories 
around an individuals’ name, address, and SSN. The CRAs obtain 
SSNs from individuals who seek credit and from information re- 
sellers and public records. Some businesses aggregate information, 
including SSNs, from various public and private sources for resale. 
They obtain data from public records like bankruptcy proceedings, 
tax liens, and voter registration rolls — and from private compila- 
tions like telephone directories. These businesses combine and re- 
sell this information to a variety of customers. The ones we con- 
tacted told us that to comply with current law they generally limit 
their services to customers who establish accounts with them and 
with whom they have contracts that restrict the extent to which 
the data purchased can be redisclosed. 

Despite protections such as these, large databases of information 
still represent a vulnerability for Americans. In the course of our 
work we have identified numerous instances in which the public 
and private databases have been compromised and personal data, 
including SSNs, stolen. Such cases illustrate the vulnerability of 
these databases to criminal misuse. Let me turn now to the role 
of the SSA in preventing the proliferation of false identities. This 
Subcommittee asked us to examine two aspects of the SSA role: 
SSA’s assignment of new SSNs, a process called enumeration, and 
SSA’s verification of SSNs for State driver’s licensing agencies. Our 
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review of SSA’s enumeration process found that SSA has begun to 
implement important new policies and procedures to prevent the 
inappropriate assignment of SSNs to noncitizens. For example, 
SSA has required staff to verify identity information and immigra- 
tion status with the U.S. Department of State and the U.S. Depart- 
ment of Homeland Security prior to issuing an SSN. The SSA has 
also begun implementation of a program called Enumeration at 
Entry, where an applicant’s information is vetted by the Depart- 
ment of Homeland Security and the Department of State before the 
applicants enter the United States. In addition, the SSA has cre- 
ated a special center in Brooklyn, New York to focus solely on enu- 
meration and verification. 

These three initiatives all hold promise of improved enumeration 
accuracy. However, the enumeration process overall still has 
vulnerabilities that could result in fraudulent use of Social Security 
cards and SSNs. I am speaking specifically of replacement Social 
Security cards and policies regarding SSNs for children under the 
age of 1. Let me turn to those now. As to replacement cards, SSA 
policy currently allows individuals to obtain up to 52 replacement 
cards a year. That is one a week. Of the 18 million cards SSA 
issued last year, 12.4 million, or almost 70 percent, were replace- 
ments. While SSA requires noncitizens to provide the same identity 
and immigration information that they need to obtain an original 
card when they get a replacement, citizens can use things like 
health insurance cards or church memberships when they apply for 
replacements. The ease of obtaining replacements creates the po- 
tential that these cards can be accumulated and sold to those not 
eligible for their own cards. This is an obvious vulnerability that 
should be better controlled. 

With regard to enumerating young children, although SSA re- 
vised its policies to require that field staff obtain verification of 
birth records for most U.S. -born individuals applying for enumera- 
tion, agency policy requires only visual inspection of a birth certifi- 
cate for children under the age of 1. Although such visual inspec- 
tion can identify false documents, and indeed we found an instance 
where an alert Social Security field office staff member did identify 
a false birth certificate, we were able ourselves to create false docu- 
ments and enumerate two nonexistent infants; the documents we 
used to do this are shown in the exhibit on your right. It is the left 
board, and I believe you have that in your packets in front of you. 
We have full names and other identifying information blacked out 
for security reasons. To support our applications for these cards, we 
used fake documents that you see on the left under the heading, 
“counterfeit documents.” We used birth certificates and certificates 
of baptism for both of the applications we made. In one we used 
an employer identification card. In the other we also used a State 
driver’s license to provide identification for the so-called parents 
who were applying for this infant’s card. We created these docu- 
ments with inexpensive, commercially-available software. You see 
the results on the right. We received one card already, and the 
written assurance below is that the other card is in the mail. After 
receiving these cards for children who do not exist we could have 
passed them to someone who is not eligible for a SSN. We wouldn’t 
do that, but it is a clear vulnerability that SSA needs to address. 
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Let me now move on to SSA’s verification of information for 
State driver’s licensing agencies. Since driver’s licenses are a wide- 
ly accepted form of identification, the agencies that issue such li- 
censes can be focal points for identity fraud. The SSA has a 
verification service in place that allows State agencies to verify the 
name, date of birth, and SSN of driver’s license applicants. In our 
work for this Subcommittee and the House Judiciary Committee, 
we have found that 25 States have used the SSA service, but they 
have not all used it regularly. Most of them use the online 
verification method, but a few use only the batch method, which 
takes longer but costs less to use. States that don’t use either 
verification method told us they were concerned about start-up 
costs and system performance. Indeed, there are 10 States awaiting 
improvement to the online verification system’s capacity before 
they can be allowed to use it. Others already using the system have 
scaled back their use because of capacity problems. 

In addition to the capacity problems the system has experienced, 
we also identified a key weakness in the batch method that exposes 
States to a higher risk of fraud. Unlike the online method, batch 
does not match verification requests against SSA’s death records. 
As a result, the batch method will verify the name and SSN of a 
dead person as an accurate record. We observed this ourselves and 
again we have prepared a visual to illustrate — the one on the right. 
Our undercover investigators were able to obtain licenses in two 
States that use the batch verification method. We presented coun- 
terfeit identity documents that contain the name, data of birth, and 
SSN of a dead person to motor vehicle agencies in these States. In 
one instance, you can see we presented a fake birth certificate, a 
military identification, and a Social Security card. In another, we 
presented only the fake Social Security card and a fake driver’s li- 
cense from another State. In both instances, we received the driv- 
er’s licenses you see before you on the right. The ease with which 
our staff were able to obtain these licenses suggests that the batch 
method must change and must change immediately to protect the 
State driver’s licensing system. Our report on this topic will be 
issued in September and is likely to contain recommendations to 
improve SSA’s verification systems, both online and batch. 

In conclusion, let me say that SSNs are used for many beneficial 
purposes, but as we all know SSNs are also used for illegal finan- 
cial gain and for immigration fraud. While most uses are for the 
benefit of the taxpayer and to ease the provision of various services 
such as granting credit, this personal information is not always 
adequately protected. Further, those who would live in the United 
States illegally have sought not just stolen SSNs, but their own So- 
cial Security cards and driver’s licenses — fraudulently obtained, of 
course. The SSA has an important role to play both in limiting the 
issuance of SSNs only to those who are eligible to have them and 
to verifying personal information for State driver’s licensing agen- 
cies. While progress is being made on both these fronts, we have 
demonstrated the vulnerabilities that remain. We look forward to 
continuing work with this Subcommittee to strengthen needed pro- 
tections to ensure that false identities are not readily available to 
those who would harm the United States and its people. That con- 
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eludes my statement, Mr. Chairman. I really appreciate the extra 
time, and I am here to answer any questions. 

[The prepared statement of Ms. Bovbjerg follows:] 

Statement of Barbara D. Bovbjerg, Director, Education, Workforce, and In- 
come Security Issues, U.S. General Accounting Office; accompanied by 

Dan Bertoni, Deputy Director 

Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss ways to better protect Social Security 
Numbers (SSNs) to help prevent the proliferation of false identities whether for fi- 
nancial misuse or for assuming an individual’s identity. Although the Social Secu- 
rity Administration (SSA) originally created SSNs as a means to track worker’s 
earnings and eligibility for Social Security benefits, over time the SSN has come to 
be used for a myriad of purposes. As you know, SSNs are a key piece of information 
in creating false identities. Allegations of SSN misuse include, for example, inci- 
dents where a criminal uses the SSN of another individual for the purpose of fraud- 
ulently obtaining credit, acquiring goods, violating immigration laws, or fleeing the 
criminal justice system. 

Although Congress has passed a number of laws to protect the security of per- 
sonal information, the continued use of and reliance on SSNs by private and public 
sector entities and the potential for misuse underscores the importance of identi- 
fying areas that can be further strengthened. Accordingly, you asked us to talk 
about the uses of SSNs and ways that the integrity of the SSN may be preserved. 
My remarks today will focus on describing (1) public and private sector use and dis- 
play of SSNs, and (2) SSA’s role in preventing the proliferation of false identities. 
My testimony is based on a report we did for this subcommittee on government uses 
of the SSN, 1 ongoing work that focuses on private sector SSN uses, and work we 
are completing on SSA’s enumeration process and the agency’s verification of SSNs 
for state driver licensing. 

In summary, public and some private sector entities rely extensively on SSNs. We 
reported last year that federal, state and county government agencies rely exten- 
sively on the SSN to manage records, verify eligibility of benefit applicants, collect 
outstanding debt, and conduct research and program evaluations. SSNs are also dis- 
played on a number of public record documents that are routinely made available 
to the public. To improve customer service, some state and local government entities 
are considering placing more public records on the Internet. In addition, some pri- 
vate sector entities have come to rely on the SSN as an identifier, using it and other 
information to accumulate information about individuals. This is particularly true 
of entities that amass public and private data, including SSNs, for resale. Certain 
laws have helped to restrict the use of SSN and other information by these private 
sector entities to specific purposes. However, as a result of the increased use and 
availability of SSN information and other data, more and more personal information 
is being centralized into various corporate and public databases. Because SSNs are 
often the identifier of choice among individuals seeking to create false identities, to 
the extent that personal information is aggregated in public and private sector data- 
bases it becomes vulnerable to misuse. 

As the agency responsible for issuing SSNs and maintaining the earnings records 
and other personal information for millions of SSN holders, SSA plays a unique role 
in helping to prevent the proliferation of false identities. Following the events of 
September 11, 2001, SSA formed a task force to address weaknesses in the enu- 
meration process and developed major new initiatives to prevent the inappropriate 
assignment of SSNs to non-citizens, who represent the bulk of new SSNs issued by 
SSA’s 1,300 field offices. For example, SSA now requires field staff to independently 
verify the identity information and immigration status of all non-citizen applicants 
with the Department of Homeland Security (DHS), prior to issuing an SSN. How- 
ever, some SSA field staff are relying exclusively on the DHS verification system, 
while neglecting other standard practices for visually inspecting documents. SSA’s 
automated system for assigning SSNs also does not prevent the issuance of an SSN 
if staff by-pass required verification steps. Other areas remain vulnerable and could 
be targeted by those seeking fraudulent SSNs. These include SSA’s process for as- 
signing social security numbers for children under age one and issuing replacement 
social security cards. In addition to its enumeration process, SSA provides a service 
to states to verify the SSNs of individuals seeking driver’s licenses. We found that 


1 U.S. General Accounting Office, Social Security Numbers: Government Benefits from SSN 
Use but Could Provide Better Safeguards, GAO-02-352 (Washington D.C.: May 31, 2002). 
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fewer than half the states have used SSA’s service and the extent to which they 
regularly use the service varies widely across states. Factors such as cost, problems 
with system reliability, and state priorities and policies determine whether or not 
states use SSA’s service. We also identified a weakness in SSA’s verification service 
that exposes some states to fraud by those who would use the SSN of a deceased 
individual. 

BACKGROUND 

The Social Security Act of 1935 authorized the Social Security Administration to 
establish a recordkeeping system to help manage the Social Security program, and 
resulted in the creation of the SSN. Through a process known as “enumeration,” 
unique numbers are created for every person as a work and retirement benefit 
record for the Social Security program. Today, SSNs are generally issued to most 
U.S. citizens and are also available to, non-citizens lawfully admitted to the U.S. 
with permission to work. Lawfully admitted non-citizens may also qualify for a SSN 
for nonwork purposes when a federal, state, or local law requires an SSN to obtain 
a particular welfare benefit or service. SSA is required to verify information from 
such applicants regarding their age, identity, foreign citizenship, and immigration 
status. Most of the agency’s enumeration workload involves U.S. citizens who gen- 
erally receive SSNs via SSA’s birth registration process handled by hospitals. How- 
ever, individuals seeking SSNs can also apply in-person at any of SSA’s field loca- 
tions, through the mail, or via the Internet. 

The uniqueness and broad applicability of the SSN have made it the identifier of 
choice for government agencies and private businesses, both for compliance with fed- 
eral requirements and for the agencies’ and businesses’ own purposes. In addition, 
the boom in computer technology over the past decades has prompted private busi- 
nesses and government agencies to rely on SSNs as a way to accumulate and iden- 
tify information for their databases. As such, SSNs are often the identifier of choice 
among individuals seeking to create false identities. Law enforcement officials and 
others consider the proliferation of false identities to be one of the fastest growing 
crimes today. In 2002, the Federal Trade Commission received 380,103 consumer 
fraud and identity theft complaints, up from 139,007 in 2000. 2 In 2002, consumers 
also reported losses from fraud of more than $343 million. In addition, identity 
crime accounts for over 80 percent of social security number misuse allegations ac- 
cording to the SSA. 

PUBLIC AND PRIVATE SECTOR USES AND DISPLAY OF SSNS 

As we reported to you last year, federal, state, and county government agencies 
use SSNs. 3 When these entities administer programs that deliver services and bene- 
fits to the public, they rely extensively on the SSNs of those receiving the benefits 
and services. Because SSNs are unique identifiers and do not change, the numbers 
provide a convenient and efficient means of managing records. They are also par- 
ticularly useful for data sharing and data matching because agencies can use them 
to check or compare their information quickly and accurately with that from other 
agencies. In so doing, these agencies can better ensure that they pay benefits or pro- 
vide services only to eligible individuals and can more readily recover delinquent 
debts individuals may owe. In addition to using SSNs to deliver services or benefits, 
agencies also use or share SSNs to conduct statistical research and program evalua- 
tions. Moreover, most of the government departments or agencies we surveyed use 
SSNs to varying extents to perform some of their responsibilities as employers, such 
as paying their employees and providing health and other insurance benefits. 

Many of the government agencies we surveyed in our work last year reported 
maintaining public records that contain SSNs. This is particularly true at the state 
and county level where certain offices such as state professional licensing agencies 
and county recorders’ offices have traditionally been repositories for public records 
that may contain SSNs. These records chronicle the various life events and other 
activities of individuals as they interact with the government, such as birth certifi- 
cates, professional licenses, and property title transfers. Generally, state law gov- 
erns whether and under what circumstances these records are made available to the 
public, and they vary from state to state. They may be made available for a number 
of reasons, including the presumption that citizens need key information to ensure 
that government is accountable to the people. Certain records maintained by fed- 
eral, state, and county courts are also routinely made available to the public. In 


2 Identity theft records broken out of consumer fraud totaled per year: 31,117(2000), 
86,198(2001), and 161,819(20021. 

3 U.S. General Accounting Office, Social Security Numbers: Government Benefits from SSN 
Use but Could Provide Better Safeguards, GAO-02-352 (Washington D.C.: May 2002). 
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principle, these records are open to aid in preserving the integrity of the judicial 
process and to enhance public trust and confidence in the judicial process. At the 
federal level, access to documents generally has its grounding in common law and 
constitutional principles. In some cases, public access is also required by statute, as 
is the case for papers filed in a bankruptcy proceeding. As with federal courts, re- 
quirements regarding access to state and local court records may have a state com- 
mon law or constitutional basis or may be based on state laws. 

Although public records have traditionally been housed in government offices and 
court buildings, to improve customer service, some state and local government enti- 
ties are considering placing more public records on the Internet. Because such ac- 
tions would create new opportunities for gathering SSNs from public records on a 
broad scale, we are beginning work for this subcommittee to examine the extent to 
which SSNs in public records are already accessible via the Internet. 

In our current work, we found that some private sector entities also rely exten- 
sively on the SSN. Businesses often request an individual’s SSN in exchange for 
goods or services. For example, some businesses use the SSN as a key identifier to 
assess credit risk, track patient care among multiple providers, locate bankruptcy 
assets, and provide background checks on new employees. In some cases, businesses 
require individuals to submit their SSNs to comply with federal laws such as the 
tax code. Currently, there is no law that prohibits businesses from requiring a per- 
son’s SSN as a condition of providing goods and services. If an individual refuses 
to give his or her SSN to a company or organization, they can be refused goods and 
services unless the SSN is provided. 

To build on previous work we did to determine certain private sector entities use 
of SSNs, we have focused our initial private sector work on information resellers 
and consumer reporting agencies (CRAs). 4 Some of these entities have come to rely 
on the SSN as an identifier to accumulate information about individuals, which 
helps them determine the identity of an individual for purposes such as employment 
screening, credit information, and criminal histories. This is particularly true of en- 
tities, known as information resellers, who amass personal information, including 
SSNs. Information resellers often compile information from various public and pri- 
vate sources. 5 These entities provide their products and services to a variety of cus- 
tomers, although the larger ones generally limit their services to customers that es- 
tablish accounts with them, such as entities like law firms and financial institu- 
tions. Other information resellers often make their information available through 
the Internet to persons paying a fee to access it. 

CRAs are also large private sector users of SSNs. These entities often rely on 
SSNs, as well as individuals’ names and addresses to build and maintain credit his- 
tories. Businesses routinely report consumers’ financial transactions, such as 
charges, loans, and credit repayments to CRAs. CRAs use SSNs to determine con- 
sumers’ identities and ensure that incoming consumer account data is matched cor- 
rectly with information already on file. 

Certain laws such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, 
and the Driver’s Privacy Protection Act have helped to limit the use of personal in- 
formation, including SSNs, by information resellers and CRAs. These laws limit the 
disclosure of information by these entities to specific circumstances. In our discus- 
sion with some of the larger information resellers and CRAs, we were told that they 
have to take specific actions to adhere to these laws, such as establishing contracts 
with their clients specifying that the information they obtain will be used only for 
accepted purposes under the law. 

The extensive public and private sector uses of SSNs and availability of public 
records and other information, especially via the Internet, has allowed individuals’ 
personal information to be aggregated into multiple databases or centralized loca- 
tions. In the course of our work, we have identified numerous examples where pub- 
lic and private databases have been compromised and personal data, including 
SSNs, has been stolen. In some instances, the display of SSNs in public records and 
easily accessible websites provided the opportunity for identity thieves. In other in- 
stances, databases not readily available to outsiders have had their security 
breached by employees with access to key information. For example, in our current 
work, we identified a case where two individuals obtained the names and SSNs of 
325 high-ranking United States military officers from a public Website, then used 


4 U.S. General Accounting Office, Social Security: Government and Commercial Use of the So- 
cial Security Number is Widespread, GAO/HEHS-99-28 (Washington, D.C.: Feb. 16, 1999.) 

5 The information compiled may include public records of bankruptcy, tax liens, civil judg- 
ments, criminal histories, deaths, real estate ownership, driving histories, voter registration, and 
professional licenses. Private data sources include information from telephone directories and 
copyrighted publications. 
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those names and identities to apply for instant credit at a leading computer com- 
pany. Although criminals have not accessed all public and private databases, such 
cases illustrate that these databases are vulnerable to criminal misuse. 

SSA HAS A ROLE IN PREVENTING SSNS FROM BEING USED TO CRE- 
ATE FALSE IDENTITIES BUT SOME AREAS REMAIN VULNERABLE 

Because SSA is the issuer and custodian of SSN data, SSA has a unique role in 
helping to prevent the proliferation of false identities. Following the events of Sep- 
tember 11, 2001, SSA began taking steps to increase management attention on enu- 
meration and formed a task force to address weaknesses in the enumeration proc- 
ess. As a result of this effort, SSA has developed major new initiatives to prevent 
the inappropriate assignment of SSNs to non-citizens. However, our preliminary 
findings to date identified some continued vulnerabilities in the enumeration proc- 
ess including SSA’s process for issuing replacement Social Security cards and as- 
signing SSNs to children under age one. SSA is also increasingly called upon by 
states to verify the identity of individuals seeking driver licenses. We found that 
fewer than half the states have used SSA’s service and the extent to which they 
regularly use the service varies widely. Factors such as costs, problems with system 
reliability, and state priorities have affected states use of SSA’s verification service. 
We also identified a key weakness in the service that exposes some states to inad- 
vertently issuing licenses to individuals using the SSNs of deceased individuals. We 
plan to issue reports on these issues in September that will likely contain rec- 
ommendations to improve SSA’s enumeration process and its SSN verification serv- 
ice. 

SSA’s Enumeration Process Helps Prevent the Proliferation of False Identities, but 
Additional Actions are Needed to Safeguard the Issuance of SSNs 

SSA has increased document verifications and developed new initiatives to pre- 
vent the inappropriate assignment of Social Security numbers (SSNs) to non-citizens 
who represent the bulk of all initial SSNs issued by SSA’s 1,300 field offices. How- 
ever, in some key areas, weaknesses remain. SSA has increased document 
verifications by requiring independent verification of the documents and immigra- 
tion status of all non-citizen applicants with the issuing agency — namely the De- 
partment Homeland Security (DHS) and Department of State (State Department) 
prior to issuing the SSN. However, in our audit work, we found that many field of- 
fices are relying heavily on DHS’s verification service, while neglecting standard, in- 
house practices for visually inspecting and verifying identity documents. We also 
found that while SSA has made improvements to its automated system for assigning 
SSNs, the system is not designed to prevent the issuance of an SSN if field staff 
by-pass essential verification steps. SSA also has begun requiring foreign students 
to show proof of their full-time enrollment, but does not require field staff to verify 
with the school the students’ enrollment or their authorization to work. Con- 
sequently, SSNs for non-citizen students may still be improperly issued. 

SSA has also undertaken other new initiatives to shift the burden of processing 
non-citizen applications from its field offices. SSA recently piloted a specialized cen- 
ter in Brooklyn, New York, which focuses exclusively on enumeration and utilizes 
the expertise of DHS document examiners and SSA’s OIG investigators. However, 
the future of this pilot project and DHS’ participation has not yet been determined. 
Meanwhile, in late 2002, SSA began a phased implementation of a long-term proc- 
ess to issue SSNs to non-citizens at the point of entry into the United States, called 
“Enumeration at Entry” (EAE). EAE offers the advantage of using State Depart- 
ment and DHS expertise to authenticate information provided by applicants for sub- 
sequent transmission to SSA who then issues the SSN. Currently, EAE is limited 
to immigrants age 18 and older who have the option of applying for an SSN at one 
of the 127 State posts worldwide that issue immigrant visas. SSA has experienced 
problems with obtaining clean records from both the State Department and DHS, 
but plans to continue expanding the program over time to include other non-citizen 
groups, such as students and temporary visitors. The agency also intends to evalu- 
ate the initial phase of EAE in conjunction with the State Department and DHS. 
However, this evaluation has not yet been planned or scheduled. 

While SSA has embarked on these new initiatives, it has not tightened controls 
in two key areas of its enumeration process that could be exploited by individuals 
seeking fraudulent SSNs. One area is the assignment of SSNs to children under age 
one. Prior work by SSA’s Inspector General identified the assignment of SSNs to 
children as an area prone to fraud because SSA did not independently verify the 
authenticity of various state birth certificates. Despite the training and guidance 
provided to field office employees, the OIG found that the quality of many counter- 
feit documents was often too good to detect simply by visual inspection. Last year, 
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SSA revised its policies to require that field staff obtain independent third party 
verification of the birth records for U.S.-born individuals age one and older from the 
state or local bureau of vital statistics prior to issuing an SSN card. 6 However, SSA 
left in place its policy for children under age one and continues to require only a 
visual inspection of documents, such as birth records. 

SSA’s policies relating to enumerating children under age one expose the agency 
to fraud. During our fieldwork, we found an example of a non-citizen who submitted 
a counterfeit birth certificate in support of an SSN application for a fictitious U.S. 
born child under age one. In this case, the SSA field office employee identified the 
counterfeit state birth certificate by comparing it with an authentic one. However, 
SSA staff acknowledged that if a counterfeit out-of-state birth certificate had been 
used, SSA would likely have issued the SSN because of staff unfamiliarity with the 
specific features of the numerous state birth certificates. Further, we were able to 
prove the ease with which individuals can obtain SSNs by exploiting SSA’s current 
processes. Working in an undercover capacity our investigators were able to obtain 
two SSNs. By posing as parents of newborns, they obtained the first SSN by apply- 
ing in-person at a SSA field office using a counterfeit birth certificate and baptismal 
certificate. Using similar documents, a second SSN was obtained by our investiga- 
tors who submitted all material via the mail. In both cases, SSA staff verified our 
counterfeit documents as being valid. SSA officials told us that they are re-evalu- 
ating their policy for enumerating children under age one. However, they noted that 
parents often need an SSN for their child soon after birth for various reasons such 
as for income tax purposes. They acknowledge that a challenge facing the agency 
is to strike a better balance between serving the needs of the public and ensuring 
SSN integrity. 

In addition to the assignment of SSNs to children under the age of one, SSA’s 
policy for replacing Social Security cards also increases the potential for misuse of 
SSNs. SSA does not limit the number of replacement cards individuals can receive. 
Of the 18 million cards issued by SSA in FY2002, 12.4 million, or 69 percent, were 
replacement cards. More than 1 million of these cards were issued to non-citizens. 
In several of the field offices we visited, replacement cards represented 70 percent 
of the total enumeration workload. While SSA requires non-citizens applying for a 
replacement card to provide the same identity and immigration information as if 
they were applying for an original SSN, SSA’s evidence requirements for citizens 
are much less stringent. Citizens applying for a replacement card need not prove 
their citizenship; they may use as proof of identity such documents as a driver’s li- 
cense, passport, employee identification card, school identification card, church 
membership or confirmation record, life insurance policy, or health insurance card. 
The ability to obtain numerous replacement SSN cards with less documentation cre- 
ates a condition for requestors to obtain SSNs for a wide range of illicit uses includ- 
ing selling them to non-citizens. These cards can be sold to individuals seeking to 
hide or create a new identity, perhaps for the purpose of some illicit activity. SSA 
told us the agency is considering limiting the number of replacement cards with cer- 
tain exceptions such as for name changes, administrative errors, and hardships. 
However, they cautioned that while support exists for this change within the agen- 
cy, some advocacy groups oppose such a limit. 

Field staff we interviewed told us that despite their reservations regarding indi- 
viduals seeking excessive numbers of replacement cards, they were required under 
SSA policy to issue the cards. Many of the field office staff and managers we spoke 
to acknowledged that the current policy weakens the integrity of SSA’s enumeration 
process. 

SSA’s Verification of Driver Licenses Applicants Helps Prevent Fraudulent Docu- 
ments, but Vulnerabilities Still Exist 

The events of September 11 th , 2001 focused attention on the importance of identi- 
fying people who use false identity information or documents, particularly in the 
driver licensing process. Driver licenses are a widely accepted form of identification 
that individuals frequently use to obtain services or benefits from federal and state 
agencies, open a bank account, request credit, board an airplane, and carry on other 


6 Most U.S. -born individuals receive a SSN through a process SSA refers to as Enumeration- 
at -Birth (EAB). Under EAE parents can apply for a SSN for their newborn child at the hospital 
as part of the birth registration process. Under this process hospitals send birth registration in- 
formation to a state or local bureau of vital statistics where it is put into a database. SSA ac- 
cepts the data captured during the birth registration process as evidence of age, identity, and 
citizenship, and assigns the child an SSN without further parental involvement. The appropriate 
bureau of vital statistics forwards SSA the required information, usually by electronic means. 
Once SSA receives the required information, it performs edits, assigns the SSN and issues the 
card. 
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important activities of daily living. For this reason, driver licensing agencies are 
points at which individuals may attempt to fraudulently obtain a license using a 
false name, social security number (SSN), or other documents such as birth certifi- 
cates to secure this key credential. 

Given that most states collect SSNs during the licensing process, SSA is uniquely 
positioned to help states verify the identity information provided by applicants. To 
this end, SSA has a verification service in place that allows state driver licensing 
agencies to verify the SSN, name, and date of birth of customers with SSA’s master 
file of SSN owners. States can transmit requests for SSN verification in two ways. 
One is by sending multiple requests together, called the “batch” method, to which 
SSA reports it generally responds within 48 hours. The other way is to send an indi- 
vidual request on-line, to which SSA responds immediately. 

Twenty-five states have used the batch or on-line method to verify SSNs with SSA 
and the extent to which they use the service on a regular basis varies. About three- 
fourths of the states that rely on SSA’s verification service used the on-line method 
or a combination of the on-line and batch method, while the remaining states used 
the batch method exclusively. Over the last several years, batch states estimated 
submitting over 84 million batch requests to SSA compared to 13 million requests 
submitted by on-line users. States’ use of SSA’s on-line service has increased stead- 
ily over the last several years. However, the extent of use has varied significantly, 
with 5 states submitting over 70 percent of all on-line verification requests and one 
state submitting about one-third of the total. 

Various factors, such as costs, problems with system reliability, and state prior- 
ities affect states’ decisions regarding use of SSA’s verification service. In addition 
to the per-transaction fees that SSA charges, states may incur additional costs to 
set up and use SSA’s service, including the cost for computer programming, equip- 
ment, staffing, training, and so forth. Moreover, states’ decisions about whether to 
use SSA’s service, or the extent to which to use it, are also driven by internal poli- 
cies, priorities, and other concerns. For example, some of the states we visited have 
policies requiring their driving licensing agencies to verify all customers’ SSNs. 
Other states may limit their use of the on-line method to certain targeted popu- 
lations, such as where fraud is suspected or for initial licenses, but not for renewals 
of in-state licenses. The non-verifying states we contacted expressed reluctance to 
use SSA’s verification service based on performance problems they had heard were 
encountered by other states. Some states cited concerns about frequent outages and 
slowness of the on-line system. Other states mentioned that the extra time to verify 
and resolve SSN problems could increase customer waiting times because a driver 
license would not be issued until verification was complete. 

Indeed, weaknesses in SSA’s design and management of its SSN on-line 
verification services have limited its usefulness and contributed to capacity and per- 
formance problems. SSA used an available infrastructure to set up the system and 
encountered capacity problems that continued and worsened after the pilot phase. 
The capacity problems inherent in the design of the on-line system have affected 
state use of SSA’s verification service. Officials in one state told us that they have 
been forced to scale back their use of the system because they were told by SSA 
that their volume of transactions were overloading the system. In addition, because 
of issues related to performance and reliability, no new states have used the service 
since the summer of 2002. At the time of our review, 10 states had signed agree- 
ments with SSA and were waiting to use the on-line system and 17 states had re- 
ceived funds from Department of Transportation for the purpose of verifying SSNs 
with SSA. It is uncertain how many of the 17 states will ultimately opt to use SSA’s 
on-line service. However, even if they signed agreements with SSA today, they may 
not be able to use the service until the backlog of waiting states is addressed. More 
recently, SSA has made some necessary improvements to increase system capacity 
and to refocus its attention to the day-to-day management of the service. However, 
at the time of our review, the agency still has not established goals for the level 
of service it will provide to driver licensing agencies. 

In reviewing SSA’s verification service, we identified a key weakness that exposes 
some states to issuing licenses to applicants using the personal information of de- 
ceased individuals. Unlike the on-line service, SSA does not match batch requests 
against its nationwide death records. As a result, the batch method will not identify 
and prevent the issuance of a license in cases where an SSN name and date of birth 
of a deceased individual is being used. SSA officials told us that they initially devel- 
oped the batch method several years ago and they did not design the system to 
match SSNs against its death files. However, in developing the on-line system for 
state driver licensing agencies, a death match was built into the new process. At 
the time of our review, SSA acknowledged that it had not explicitly informed states 
about the limitation of the batch service. 
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Our own analysis of one month of SSN transactions submitted to SSA by one 
state using the batch method identified at least 44 cases in which individuals used 
the SSN, name, and date of birth of persons listed as deceased in SSA’s records to 
obtain a license or an identification card. 7 We forwarded this information to state 
investigators who quickly confirmed that licenses and identification cards had been 
issued in 41 cases and were continuing to investigate the others. To further assess 
states’ vulnerability in this area, our own investigators working in an undercover 
capacity were able to obtain licenses in two batch states using a counterfeit out-of- 
state license and other fraudulent documents and the SSNs of deceased persons. In 
both states, driver licensing employees accepted the documents we submitted as 
valid. Our investigators completed the transaction in one state and left with a new 
valid license. 8 In the second state, the new permanent license arrived by mail with- 
in weeks. The ease in which they were able to obtain these licenses confirmed the 
vulnerability of states currently using the batch method as a means of SSN 
verification. Moreover, states that have used the batch method in prior years to 
clean up their records and verify the SSNs of millions of driver license holders, may 
have also unwittingly left themselves open to identity theft and fraud. 

CONCLUSIONS 

The use of SSNs by both public and sector entities is likely to continue given that 
it is used as the key identifier by most of these entities and there is currently no 
other widely accepted alternative. To help control such use, certain laws have 
helped to safeguard such personal information, including SSNs, by limiting disclo- 
sure of such information to specific purposes. To the extent that personal informa- 
tion is aggregated in public and private sector databases, it becomes vulnerable to 
misuse. In addition, to the extent that public record information becomes more 
available in an electronic format, it becomes more vulnerable to misuse. The ease 
of access the Internet affords could encourage individuals to engage in information 
gathering from public records on a broader scale than they could before when they 
had to visit a physical location and request or search for information on a case-by- 
case basis. 

SSA has made substantial progress in protecting the integrity of the SSN by re- 
quiring that the immigration and work status of every non-citizen applicant be 
verified before an SSN is issued. However, without further system improvements 
and assurance that field offices will comply fully with the new policies and proce- 
dures this effort may be less effective than it could be. Further, as SSA closes off 
many avenues of unauthorized access to SSNs, perpetrators of fraud will likely shift 
their strategies to less protected areas. In particular, SSA’s policies for enumerating 
children and providing unlimited numbers of replacement cards may well invite 
such activity, unless they too are modified. 

State driver license agencies face a daunting task in ensuring that the identity 
information of those to whom they issues licenses is verified. States effectiveness 
verifying individual’s identities is often dependent on several factors, including the 
receipt of timely and accurate identity information from SSA. Unfortunately, design 
and management weaknesses associated with SSA’s verification service have limited 
its effectiveness. States that are unable to take full advantage of the service and 
others that are waiting for the opportunity to use it remain vulnerable to identity 
crimes. In addition, states that continue to rely primarily or partly on SSA’s batch 
verification service still risk issuing licenses to individuals using the SSNs and 
other identity information of deceased individuals. This remains a critical flaw in 
SSA’s service and states’ efforts to strengthen the integrity of the driver license. 

GAO is preparing to publish reports covering the work I have summarized within 
the next several months, which will include recommendations aimed at ensuring the 
integrity of the SSN. We look forward to continuing to work with this Subcommittee 
on these important issues. I would be happy to respond to any questions you or 
other members of the Subcommittee may have. 

CONTACTS AND ACKNOWLEDGMENTS 

For further information regarding this testimony, please contact Barbara D. 
Bovbjerg, Director, or Dan Bertoni, Assistant Director, Education, Workforce, and 
Income Security at (202) 512-7215. Individuals making key contributions to this 
testimony include Mindy Bowman, Alicia Cackley, Tamara Cross, Patrick 


7 SSA’s death records may contain inaccuracies because SSA records all reports of death but 
only verifies those involving benefit payments. 

8 This state does not use SSA’s batch verification process for initial licenses, but only for li- 
cense renewals. Therefore, the use of the deceased person’s SSN will not be caught by the sys- 
tem when the state ultimately verifies it using the batch method. 
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DiBattista, Melissa Hinton, Jason Holsclaw, George Scott, Jacquelyn Stewart, and 
Tony Wysocki. 


Chairman SHAW. Very good. We appreciate your testimony. Mr. 
Huse. 

STATEMENT OF THE HONORABLE JAMES G. HUSE, JR., 
INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION 

Mr. HUSE. Thank you, Mr. Chairman, Mr. Matsui, and Members 
of the Subcommittee. As always — and I have probably been here 
nine times — it is a pleasure to be here to assist you in your impor- 
tant work involving the SSN and its protection. In the interest of 
brevity and since you have accepted my full written testimony, I 
will summarize the major points that I have in that testimony. 
This Subcommittee and the Office of the Inspector General have 
been fighting SSN misuse and identity theft together for quite a 
few years now, beginning when I was Acting Inspector General at 
Social Security. So, now I am pleased to be here today and to see 
that the Subcommittee’s continuing and tenacious dedication to 
stopping and reversing what is now a long-standing upward trend 
in SSN misuse and identity theft has never wavered. I come in 
support of legislation to strengthen protection for the SSN, our na- 
tional identifier. We as a government remain ill-equipped to afford 
it the protection it needs and deserves. We need to protect the SSN 
at three stages: upon issuance, during the life of the number hold- 
er, and following the number holder’s death. Perhaps the most im- 
portant step we can take in preventing SSN misuse is to limit the 
SSNs’ easy availability. Any meaningful legislation designed to pro- 
tect the SSN must strictly limit the number’s availability on public 
documents. The financial industry relies on the SSN and no one is 
suggesting that we change the way legitimate business is con- 
ducted in the United States. The use of the SSN as a student or 
patient identification number, as part of a car rental contract or to 
rent a video must be curtailed. 

Finally, I respect and support the SSA’s strict privacy regula- 
tions. The information SSA stores on each of us is personal and is 
entitled to all of the protections we can provide. However, there are 
times when that privacy must be abridged for the greater good. 
Following September 11th, and again during last year’s sniper at- 
tacks in the Washington, D.C. area, it became necessary to share 
with appropriate law enforcement authorities information stored by 
SSA to permit those authorities to conduct their investigations and, 
more importantly, to prevent additional lives from being lost. On 
both occasions, I asked the Commissioner of Social Security to use 
the ad hoc authority vested in the Commissioner by SSA’s regula- 
tions to permit me to share SSA information with our law enforce- 
ment partners. I now ask this Subcommittee for statutory author- 
ity that would enable the Inspector General to make such disclo- 
sures when necessary to protect human lives without prior formal 
authorization from the Commissioner. When lives are at stake, we 
cannot waste precious moments in order to sustain some bureau- 
cratic modality. 
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Before I close, I would like to emphasize one part of my discus- 
sion. While the SSN is issued by SSA, the responsibility for pro- 
tecting its integrity reaches far beyond the agency’s boundaries. 
The SSA has come very far and is willing to do more, yet other 
Federal, State and local jurisdictions as well as the private sector 
must each also do their part. With everyone’s participation we can 
protect the SSN and ultimately our homeland. Mr. Chairman, I 
thank you for your continuing commitment to these critical issues. 
I might add to sharpen all of this, that this very morning in Cali- 
fornia, we, along with the Los Angeles Police Department and 
other local police departments, made a raid and have arrested 
three suspects while one suspect remains at large. We also seized 
computers, printers, books of templates of every conceivable kind 
of identification, SSNs, lists of SSNs, birth certificates, driver’s li- 
censes, the seals to make driver’s licenses, doctor’s certificates, and 
infant footprints. Now what do you think they were going to do 
with those? This is a serious matter. It goes on every day. Thank 
you, Mr. Chairman. 

[The prepared statement of Mr. Huse follows:] 

Statement of The Honorable James G. Huse, Jr., Inspector General, Social 
Security Administration 

Good Morning Mr. Chairman, Mr. Matsui, and members of the Subcommittee. As 
always, it is a pleasure to be here to assist you in your important work. We have 
been fighting Social Security number (SSN) misuse and identity theft together for 
quite a number of years now, starting when I was Acting Inspector General of the 
Social Security Administration’s (SSA) Office of the Inspector General. On March 
30, 2000, I testified before this Subcommittee about SSA program integrity issues 
in general. On that occasion, I expressed my appreciation that the Subcommittee 
had recognized the importance of confronting SSN misuse, and looked forward to 
separate hearings that you promised to hold on the issue. 

Five weeks later, on May 9, 2000, I returned and reported at length on the misuse 
of SSNs in many areas, including identity theft. I explained that my office could not 
possibly investigate every instance of identity theft that involved an SSN. I testified 
that we were working vigorously on the audit side to identify and eliminate weak- 
nesses in SSA’s enumeration process, and just as vigorously on the investigative 
side to stop SSN misuse crimes that had a direct impact on SSA’s programs and 
operations. 

In the year that followed, even as we worked to tighten controls over the issuance 
of SSNs and fought to deter and punish SSN misuse, identity theft continued to in- 
crease. It became apparent that under existing law, we could not do enough to stop 
criminals from obtaining SSNs, and did not have sufficient enforcement tools to 
deter them from doing so. 

So on May 22, 2001, I returned to this Subcommittee asking for its help. I asked 
for legislation that would severely restrict the use of SSNs in the private and public 
sector, and that would criminalize the sale of SSNs. I asked for an administrative 
safety net in the form of Civil Monetary Penalty authority for those instances of 
SSN misuse that could not be criminally prosecuted. And I pledged my office’s un- 
wavering support of the Subcommittee’s efforts to prevent SSN misuse and, by ex- 
tension, identity theft. 

The Subcommittee’s response was swift. H.R. 2036, which provided all of the relief 
I had requested and more, was an important step forward. Tragically, before we 
could take that step forward, we all took an enormous step back. September 11, 
2001 stopped us all in our tracks, and H.R. 2036 understandably took a temporary 
back seat to more pressing Congressional responsibilities. 

But it was a very short time before we collectively realized that H.R. 2036 and 
September 11 shared more common ground than we had ever contemplated. We had 
always seen SSN misuse as a bureaucratic problem for the government and a finan- 
cial problem for the private sector and the citizenry. As our investigative offices 
were besieged with requests from the FBI for assistance in the September 11 inves- 
tigation, we quickly came to realize that SSN misuse and identity theft threatened 
not only credit ratings and government records, but lives as well. 
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Shortly after the attacks on New York and Washington, I again came before this 
Subcommittee and testified about individuals seeking to assimilate themselves into 
our society for nefarious purposes. The assimilation process begins with the use of 
an SSN whether obtained legally or fabricated. Without it, I explained, it would be 
all but impossible to function in our society for any extended period. H.R. 2036, 
which had been an important piece of legislation eight weeks earlier, had become 
a critical one. Unfortunately, despite the best efforts of this Subcommittee and my 
office, the 107 th Congress adjourned before that Bill became law. 

Then just last week, Treasury Secretary John Snow called upon Congress to take 
additional steps to help stem what he correctly terms “the growing menace of iden- 
tity theft.” While the Secretary’s focus was on the harm identity theft visits upon 
consumers, this Subcommittee knows the damage is much broader than that. 

So, I am pleased to be here today, and to see that the Subcommittee’s continuing 
and tenacious dedication to stopping and reversing what is now a long-standing up- 
ward trend in SSN misuse and identity theft has never wavered. As you well know, 
the use of the SSN in American society has expanded to the breaking point. Created 
in 1935 to track workers’ earnings and pay them retirement benefits, its use has 
increased so dramatically that it has become a part of more government functions 
and financial transactions than we could ever count. It is our national identifier, 
and while it serves its purpose well, we as a government remain ill-equipped to af- 
ford it the protection it needs and deserves. 

I have previously testified as to the need to protect the SSN at three stages: upon 
issuance, during the life of the number-holder, and following the number-holder’s 
death. Tbis three-tiered approach remains critical. 

At Stage One, my office is doing more work than ever, working closely with this 
Subcommittee and SSA to strengthen controls over the enumeration process, ensure 
the integrity of identification documents, and make it as difficult as possible to ob- 
tain an SSN from the Federal government fraudulently. If we cannot accomplish 
this much — ensuring that the government is not an unwitting accomplice to identity 
theft and other SSN-related crimes — then we will have failed before we have begun. 
But I can testify today with confidence that this is not the case. Together with you 
and with SSA, we have made important strides in reducing enumeration 
vulnerabilities, and that effort continues. Still, legislation is sorely needed to limit 
the number of replacement Social Security cards an individual can obtain, and to 
require better cross-verification of records in the enumeration at birth process, to 
ensure that SSNs are not inappropriately issued in this important program. Excel- 
lent progress has been made in the enumeration arena, and we remain dedicated 
to even further improvements. At present, SSA is drafting two regulations to tighten 
the issuance of SSNs to non-workers and foreign students. 

Similarly, Stage Three, following the death of the number-holder, is an area in 
which we are working hard to ensure that, through timely reporting, appropriate 
cross-matching, and better controls, the SSNs of deceased individuals are not recy- 
cled for inappropriate purposes. 

But it is at Stage Two where we have focused the majority of our efforts, and 
where we have made the most progress. In the last several years, we have con- 
ducted numerous audits and made sweeping recommendations to SSA to improve 
the SSN misuse problem in the earnings reporting process, and most importantly, 
to improve controls over SSN misuse as it pertains specifically to Homeland Secu- 
rity. Further, over the last six months, we have led the President’s Council on Integ- 
rity and Efficiency community in conducting an audit in assessing their respective 
Agency’s practices in the use of SSNs. The final report noted that despite safeguards 
to prevent improper access, as well as disclosure and use of SSNs by external enti- 
ties, many agencies remain at risk. 

As I stated, the SSN was never intended for the uses to which it is now put mil- 
lions of times every day. The Identity Theft and Assumption Deterrence Act of 1998 
and the Internet False Identification Prevention Act of 2000 provided law enforce- 
ment with the initial tools necessary to punish SSN misuse as it relates to identity 
theft. But each SSN begins and ends at SSA, and true stewardship over that num- 
ber must reside in the Act that created it, the Social Security Act. That stewardship 
must focus not only on punishment and deterrence, but also on prevention. 

Perhaps the most important step we can take in preventing SSN misuse is to 
limit the SSN’s easy availability. Any meaningful legislation designed to protect the 
SSN must strictly limit the number’s availability on public documents. As long as 
criminals can walk into the records room of a courthouse or local government build- 
ing and walk out with names and SSNs culled from public records, we can never 
reverse the trend. Any meaningful legislation must also specifically prohibit the sale 
of SSNs — including one’s own SSN — on the open market. As long as criminals can 
buy a list of names and SSNs in an Internet auction, we will continue to be plagued 
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by the consequences. And legislation, if it is to be meaningful, must limit the use 
of the SSN to appropriate and valid transactions. 

The financial industry relies on the SSN, and no one is suggesting that we change 
the way legitimate business is conducted in the United States. But the use of the 
SSN as a student or patient identification number, as part of a car rental contract 
or to rent a video, must be curtailed. Secretary Snow commented, “Secure, reliable 
information is the lifeblood of all financial services, among which consumer credit 
is fundamental. It is not an overstatement to suggest that preserving the integrity 
and availability of consumer credit in this economy is preserving prosperity itself.” 
This is why I have testified that Congress should consider requiring the cross- 
verification of SSNs through both governmental and private sector systems of 
records to identify and address anomalies in SSA’s files, and in data bases at var- 
ious levels of government and the financial sector. Only in such a way can we com- 
bat and limit the spread of false of identification and SSN misuse. In fact, SSA has 
taken initial steps toward implementing provisions of the Patriot Act. This Act re- 
quires the Treasury Department to develop a system for domestic financial institu- 
tions to verify the identities of foreign nationals seeking to open accounts with infor- 
mation held by Government agencies. 

If we can implement these changes, all of which come down to the acceptance of 
the fact that the SSN has become our national identifier and the application of com- 
mon sense, criminals will have a far more difficult time obtaining an SSN from SSA 
or from other sources, and we will be able to better focus on enforcement. 

The Identity Theft legislation I discussed earlier provides criminal penalties, but 
those penalties were designed for broader crimes involving Social Security cards 
and/or SSNs, not for SSN misuse itself. Meaningful legislation that is focused solely 
on SSN misuse must provide meaningful criminal penalties in the Social Security 
Act, must provide enhanced penalties for those few SSA employees who betray the 
public trust and assist criminals in obtaining SSNs, and must provide an adminis- 
trative safety net in the form of Civil Monetary Penalties to allow for some form 
of relief when criminal prosecution is not available for SSN misuse and other Social 
Security-related crimes. 

Finally, I respect and support SSA’s strict privacy regulations. The information 
SSA stores on each of us is personal, and is entitled to all of the protections we can 
afford it. I have learned, however, through a series of unfortunate events, that there 
are times when that privacy must be abridged for the greater good. Following Sep- 
tember 11 th , and again during last year’s sniper attacks in the Washington, D.C. 
area, it became necessary to share with appropriate law enforcement authorities in- 
formation stored by SSA to permit those authorities to conduct their investigations 
and, more importantly, prevent additional lives from being lost. On both occasions, 
I asked the Commissioner of Social Security to use the ad hoc authority vested in 
the Commissioner by SSA regulations to permit me to share SSA information with 
our law enforcement partners. I now ask this Subcommittee for statutory authority 
that would enable the Inspector General to make such disclosures when necessary 
to protect human lives without prior formal authorization from the Commissioner. 
When lives are at stake, we cannot waste precious moments. 

Before I close, I would like to emphasize one part of my discussion. While the SSN 
is issued by SSA, the responsibility for protecting its integrity reaches far beyond 
this Agency’s walls. While SSA has come very far and is willing to do more, other 
Federal, State and local jurisdictions, as well as the private sector must each do 
their part. With everyone’s participation, we can protect the SSN and ultimately our 
homeland. 

I thank you for your continuing commitment to these critical issues, and would 
be happy to answer any questions. 


Chairman SHAW. Thank you, Mr. Huse. What is the criminal 
penalty for supplying fraudulent documents in order to obtain a So- 
cial Security card — SSN? Or is there State law that you are famil- 
iar with that would do the same thing with regard to getting a 
driver’s license that you are aware of? 

Mr. HUSE. The answer to your question is, there are Federal 
statutes that cover those crimes, and State statutes also. There is 
a strong law enforcement remedy for all of this criminal activity. 
What there isn’t, though, is an elastic enough charge or felony 
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charge for Social Security misuse in and of itself, which oftentimes 
is the common denominator through all of these levels of govern- 
ment and the crimes that have been established. If we had a 
strong, simple Social Security misuse felony, it would cut through 
a lot of this criminal justice activity. 

Chairman SHAW. Let’s take the examples that are up on the 
board. If one were to go in to the Social Security office and give 
them a birth certificate, a baptismal certificate and some other type 
of picture identification such as the one you use up there with the 
United Airlines employee type of identification, in order to obtain 
a SSN — these documents are fraudulent — what would be the crimi- 
nal penalty that this person is liable for? 

Mr. HUSE. There is a Federal criminal statute that covers this 
type of criminal activity. However, if I sold my SSN to Barbara to 
use illegally, there is no crime for the actual sale. I can’t be 
charged for that. So, these are some of the aspects of this that we 
are trying to get in a specific SSN misuse felony. 

Chairman SHAW. I am just talking about the individual who 
goes in and tries. 

Mr. HUSE. It is a crime, and we can charge them. 

Chairman SHAW. Is it a felony? 

Mr. HUSE. It is a felony crime. 

Chairman SHAW. Five years? 

Mr. HUSE. Five to 10. 

Chairman SHAW. Five to 10. Thank you. 

Mr. HUSE. I would also add that in the Federal system there are 
also the sentencing guidelines. 

Chairman SHAW. Are the prosecutors prosecuting these cases? 
Many of our courts I know in south Florida, are overworked so 
much, and the question of whether you are going to be prosecuted 
even for a felony can depend upon the severity of the felony be- 
cause of short-handedness within the prosecutor’s offices them- 
selves, the right to speedy trial, overcrowded dockets, those type of 
things. Are these cases being prosecuted? 

Mr. HUSE. Some of them are. I think the prosecutors try to do 
the right thing. They triage cases just like everybody else. There 
are those cases, as you just pointed out, that are not prosecuted, 
perhaps because the dollar amount is minimal, or the urgency, or 
there is no terrorism nexus, or what have you. Those cases usually 
fall out. That is why we are asking for this civil money penalty, a 
provision that would allow us to sanction those people who aren’t 
prosecuted. They would still have to pay a substantial fine, and in 
that way perhaps we can do something about the proliferation of 
this crime. 

Chairman SHAW. Mr. Cardin. 

Mr. CARDIN. Thank you, Mr. Chairman. Let me again thank 
our witnesses for their testimony. The SSN is supposed to be the 
identification number for the Federal Government for Social Secu- 
rity purposes. Yet it is used as an identification number by a lot 
of different organizations and groups. I have my health insurance 
card, which my membership number is identical to my SSN. I am 
sure that is not unusual. Until 2 or 3 years ago, our U.S. House 
of Representatives identification cards included, mandatorily, our 
SSNs. So, I guess my question is, how important is it for us to try 
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to protect the confidentiality of an individual SSN? You point out 
that you can go on the Internet and probably find the SSNs of most 
of us in some documents that are probably public today. If you 
couldn’t find it there you, probably with a little effort, could find 
out our SSNs. How much is that a contributing factor to identity 
theft? Should we be much more vigilant about protecting the use 
of the SSN as a way to protect against identity theft? How major 
is this? How much effort should we put behind keeping these num- 
bers confidential or for use only by the SSA? 

Ms. BOVBJERG. It couldn’t hurt to quit giving people your SSN 
when you don’t know what they are going to do with it. The Pri- 
vacy Act (P.L. 93-579) requires all levels of government, not just 
the Federal Government, when they ask for your SSN, to tell you 
whether you are required to give it, and for what purpose it is to 
be used. This is not a provision of the Privacy Act that is followed 
very routinely. We have made a recommendation to the Office of 
Management and Budget to take some action to inform government 
agencies, particularly State and local governments, that this provi- 
sion applies to them. I think as an individual it is probably also 
important to ask why Blockbuster Video or someone like that is 
asking you for your SSN and how it will be used, or to simply not 
give it to them. You are really also asking to put the genie back 
in the bottle. 

Mr. CARDIN. I don’t think people think about this. If they are 
asked to give their SSN they give their SSN because it is there, 
it is on the form. They don’t think twice about it. Unless we de- 
velop policy nationally that prevents the use of the SSN for non- 
governmental purposes or provide additional protection for the in- 
dividual to make that judgment, it seems to me it is not going to 
happen. 

Mr. HUSE. I agree with everything our distinguished witness 
from the GAO said, but I would add that that is 50 percent of the 
issue. The other 50 percent is for those numbers that are already 
out there. I believe there is also a governmental obligation to en- 
sure that there is due diligence on the data that is stored by all 
of these entities in matching those records with the true records of 
government at all of the levels, but including the Federal level — 
to ensure that there is an attempt to make positive identification 
occur. I think that is the other half of the identity theft problem. 
I think we are doing a lot of work on the front end in trying to get 
the integrity in the system that issues numbers, but we are not 
doing enough on the back end to verify that data and to make sure 
that anomalies in it are rooted out and given to appropriate law 
enforcement authorities at the local, State, county and Federal 
level to deal with. This is a universal problem, it is way beyond 
just the SSA. 

Mr. CARDIN. I agree with your point. I guess my point is, how 
do you put this all together? Would it make it a lot easier if these 
numbers weren’t so readily available? I guess the answer is, it 
wouldn’t hurt and certainly it would make it more difficult for 
identity theft. Unless we are prepared also to be very aggressive 
on the use of identity, and the verification of identity, and all the 
other issues there would still be a significant problem out there? 
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Mr. HUSE. I think you are at a point where, as Barbara said, 
you can’t put it back in the bottle. I think we have to accept the 
status quo. 

Mr. CARDIN. Why? I am not sure I agree with that. Unless we 
are willing to take action on who can use SSNs, and how they are 
to release and protect them, I agree with you. I guess my point is, 
that is one area that we could control here from Washington. It 
may cause disruptions and maybe it is not worth all the disrup- 
tions it causes, but I am trying to get a sense as to how important 
it would be to restrict the availability of SSNs. What I am getting 
from you is, that would certainly help us in reducing the amount 
of identity theft. 

Mr. HUSE. The answer is yes. 

Ms. BOVBJERG. If I could just add briefly, you have already 
done things that have helped. Certainly the Drivers Protection Act 
of 1993 (P.L. 103-322) helped enormously to prevent motor vehicle 
records that had SSNs on them from being sold in bulk. There are 
other things that have occurred over the last 10 years that have 
made the SSN, particularly in government, more secure. So, I think 
there are things that you already have done that have helped. 

Mr. CARDIN. Why should my health insurance company require 
to use my SSN? 

Ms. BOVBJERG. They want to know that you are you. It is a 
unique identifier. They want to distinguish you. 

Mr. CARDIN. Well. 

Mr. HUSE. From another person with a similar name. 

Mr. CARDIN. Is that a responsibility of government, or the pri- 
vate insurance industry? 

Ms. BOVBJERG. The government did not provide it to the insur- 
ance company. 

Mr. CARDIN. No, but we provide the SSN. Thank you, Mr. 
Chairman. 

Chairman SHAW. Mr. Collins. 

Mr. COLLINS. No questions. 

Chairman SHAW. Mr. Brady. 

Mr. BRADY. Thank you, Mr. Chairman, for holding this hearing. 
Thank you to the witnesses for being here. It is very helpful. Read- 
ing the testimony in advance, I wanted to focus on defining the 
problem a little better. It seems like there are widely varying esti- 
mates of how big a problem identity theft is. I am wondering be- 
tween thefts used for financial fraud that are — sometimes we iden- 
tify them because of complaints, those used for illegal immigration 
purposes, those used for national security access. Do you think we 
really know how big the problem of identity theft is in America 
right now? 

Mr. HUSE. I don’t think we do. The numbers that come to us 
from the financial sector are those that they choose to share with 
us. All of the credit card entities have huge insurance bonds that 
mask a lot of the activity. By this I mean that they assume a lot 
of this is risk. In the context of the national security dimension, I 
think we do get good information, and it has really been emerging 
since 9/11, as to how important it is for someone that comes into 
this country to do ill, to be able to get underneath our radar by ob- 
taining whatever requisite identification we need — principally the 
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driver’s license because that is the one that allows you to move 
around as someone who has some kind of status. I think, to use 
a metaphor, this is the tip of the iceberg. We just see the top from 
the hysteria that we hear and the reporting. I think the problem 
is far bigger than we even know. 

Mr. BRADY. Thank you. Ms. Bovbjerg. 

Ms. BOVBJERG. I agree, we don’t know. We have reported to 
Mr. Johnson in the past, that it is difficult to get statistics on this. 
I have brought Federal Trade Commission (FTC) statistics that 
said in calendar-year 2002, 380,000 consumer fraud and identity 
theft complaints came to their hotline. How many of those are 
SSN-related is unclear. They certainly don’t get at the point that 
Mr. Huse made about the criminal immigration fraud, the ter- 
rorism side of identity theft. They also reported losses of more than 
$340 million. We know that not all of these losses get reported, so 
indeed this figure is lower than actual losses. 

Mr. BRADY. Those aren’t the answers I wanted to hear, but I 
think it is what we all know in the room — that it is the tip of the 
iceberg on this issue, and leads to the follow-up question, how suc- 
cessful are we in catching and prosecuting those who steal identi- 
ties for various reasons? Do we have any numbers on how many 
prosecutions occur each year, and if I steal someone’s identity for 
whatever reason, what are the chances that I will get caught — 
other than being a Member of Congress, we are likely to get 
caught — but still in the most part, how successful are we? 

Mr. HUSE. I would say we are as successful there as we are with 
a number of issues when we talk about the criminal justice system. 
We know what we know. We have statistics, and I don’t have them 
at my finger tips but we will supply them to you later, from what 
we do and the rest of Federal law enforcement. The U.S. Depart- 
ment of Justice garners the statistics from across the country. I 
don’t think we really get at the universe of identity fraud through 
the criminal justice system. I think we probably, to use my meta- 
phor from before, I think we are just getting at the surface of it. 
It is one of those crimes that has become provocative enough to 
warrant our attention. A lot of it goes on unnoticed. Some of it is 
because a victim has to discover that they have been violated. That 
is the part we don’t really know yet. 

[The information follows:] 


Social Security Administration 
Baltimore, Maryland 21235 
May 5, 2004 


The Honorable Kevin Brady 
House of Representatives 
Washington, D.C. 20515 

Dear Mr. Brady: 

During the Ways and Means Social Security Subcommittee hearing on July 10, 
2003, you asked then Inspector General James Huse some questions related to the 
prosecution of identity theft cases. I would like to take the opportunity to respond 
to each of your questions in turn. 

First, you asked how successful we are in catching and prosecuting those who 
steal identities for various reasons. It is important to note that the Social Security 
Administration (SSA) Office of the Inspector General (OIG) is responsible for inves- 
tigating and referring for prosecution a small portion of the overall universe of iden- 
tity theft cases — those that relate to Social Security disability benefits, earnings or 
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other fraud issues that concern SSA programs generally. With regard to these cases, 
the SSA OIG has been instrumental in successfully apprehending and referring vio- 
lators for prosecution. 

Second, you asked whether we have any numbers on how many identity theft 
prosecutions occur each year. As previously stated, the SSA OIG has statistics on 
the number of identity theft prosecutions relating to Social Security fraud, but not 
the number of identity theft prosecutions that occur nationwide as the result of in- 
vestigations conducted by other federal, state and local entities. Between FY 2001 
and FY 2003, the SSA OIG investigated over 1800 allegations of identity theft re- 
lated to SSA’s programs. These cases resulted in over 1100 convictions. 

Finally, you asked how likely it is that someone will get caught for stealing an 
identity. Identity theft is often referred to as a crime that entails minimal risk. Ac- 
cording to the Federal Trade Commission, the incidence of identity theft continues 
to rise. Through its investigations of Social Security-related identity theft allega- 
tions, and its referral process, the SSA OIG is making a significant contribution to 
the fight against identity theft. It is clear that more work needs to be done. We look 
forward to working cooperatively with other agencies and the Social Security Sub- 
committee in furtherance of this effort. 

Sincerely, 

Patrick P. O’Carroll, Jr. 

Acting Inspector General 


Mr. BRADY. Sure. Ms. Bovbjerg. 

Ms. BOVBJERG. I am leaving the criminal justice statistics up 
to Mr. Huse. 

Mr. HUSE. I didn’t even answer them. 

Mr. BRADY. I think really you did. I think the point you made 
earlier about more flexible criminal justice penalties and charges I 
think are real important. Mr. Chairman, I conclude with that. I 
think your bill on Social Security theft and response is an excellent 
approach. Perhaps we ought to find a way to better define this 
problem as well as better identify how successful we are because 
then we can at least start measuring our improvement against 
that. I yield back the balance of my time. Thank you. 

Chairman SHAW. Mr. Pomeroy. 

Mr. POMEROY. Mr. Chairman, I want to commend you for not 
just this hearing, but your long-standing work on this important 
issue. I would ask Ms. Bovbjerg whether there are some systems’ 
investments that we need to make at SSA that will address some 
of the concerns your report notes. How do we get to where we need 
to go in terms of bringing a greater measure of security in the 
areas that you cite? Obviously the replacement cards, I suppose, if 
you don’t issue — you don’t allow 52 in a year would be a good start 
perhaps, but more specifically what recommendations you might 
have in that area, and the children’s cards, the batch systems, 
what specifically do you think we ought to — how should we re- 
spond? 

Ms. BOVBJERG. We are still thinking about recommendations 
in those areas. We will be issuing a report to the Subcommittee in 
September. We have been discussing these things with the SSA, 
and I know they have a concern about replacement cards and re- 
ducing the number permitted, thinking that, maybe 52 is too many, 
and certainly I think 52 is too many. The SSA raises the point 
about the homeless person who comes in regularly for his card, he 
needs it for benefits. The SSA doesn’t want to cut that person off 
from his benefits. On the other hand, perhaps that person needs 
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something more than a replacement card if he is coming in to SSA 
offices that often. We are thinking about what would be a reason- 
able approach to fixing that problem. I think we have thought, par- 
ticularly with regard to verification for enumeration that there 
might be some things that ought to be done, perhaps having SSA’s 
staff have a means to acknowledge in the SSA system that they 
have done the third party verification. That is, the new SSN num- 
ber could be issued. Things like that. These are recommendations 
that we are still thinking about, that we are discussing with the 
SSA. We don’t want to recommend something that is not feasible. 
I think there are some things that can be done to strengthen the 
verification process. 

Mr. POMEROY. Is your investigation also evaluating what legiti- 
mate private uses are occurring with SSNs as a national identifier 
in trying to find ways that put in place protections but on the other 
hand don’t unduly disrupt existing systems that depend upon this 
identifier? 

Ms. BOVBJERG. We are trying to look at that balance. In the 
work that we are doing for this Subcommittee on the private sec- 
tor, we are asking certain parts of the private sector how they are 
using the number, how do they obtain it, what safeguards they 
have, because some companies have really thought about this a lot 
and are attempting to grapple with the safeguard issue. We will be 
reporting back in the fall on this. We are still in the middle of our 
work. 

Mr. POMEROY. Mr. Huse. 

Mr. HUSE. I just wanted to say that I think I can speak for 
Commissioner Barnhart here, too, that her interest in this is as 
strong as my own. The SSA does have a regulation moving through 
the vetting process now that will restrict the number of replace- 
ment cards available to an individual during the course of the year. 
It markedly reduces the number down from 52 to 2 in a given year, 
and 10 over the course of a lifetime, which I think is far more rea- 
sonable. That is going through the vetting process in the executive 
branch before it is issued as a regulation. So, it is there. I only an- 
swered that so that you understand that the SSA is not static on 
this issue. It is just a question of the process. 

Ms. BOVBJERG. Your office too? 

Mr. HUSE. My office too. 

Mr. POMEROY. Do you have a feel for as we move to address 
identity theft it is going to significantly curtail commercial use of 
SSNs? 

Mr. HUSE. I think it will. It will probably also spur the private 
sector to look to the promise in new technology for identification 
that takes us away from the number and its universal use now to 
biometrics and other more facile uses of identification. I think by 
drawing the line now, we are saying, that the continued use of the 
SSN will become too expensive for you, it would be better to try 
another way. The information technology will require this in any 
case. 

Mr. POMEROY. Thank you. Thank you, Mr. Chairman. 

Chairman SHAW. Mr. Johnson. 

Mr. JOHNSON. Thank you, Mr. Chairman. Mr. Huse, I asked 
you a question I think before on one of your nine appearances. I 
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wonder if you could give me an update on where we are with the 
regulatory process on the issuance of SSNs for nonwork purposes 
and for foreign students as well as those who are issued to for- 
eigners. I have got a question along those lines. I believe you testi- 
fied before with reference to the illegals that were allowed to have 
work permits in Dallas, that if they were issued a work permit 
they were allowed to get a SSN. What kind of documentation do 
they use to get that, one; and two, you said it was for life, good 
for life. Is that still true? 

Mr. HUSE. Once a number is issued, it is valid for life. 

Mr. JOHNSON. Well, then, what is this deal about you all 
issuing different kinds of SSNs for temporary work permits or stu- 
dents or people who are in the country temporarily from foreign 
countries? Is there such a thing? You were talking about different 
colors, I think. 

Mr. HUSE. I never understood how complex this was until I took 
this office. 

Mr. JOHNSON. It is, but you know the currency was counter- 
feited all over the world and we came up with coloration to take 
care of that. It isn’t working, but it is still — well, it isn’t. They keep 
changing it. It is an effort to stop the counterfeit process. I wonder 
why we don’t do that with the Social Security card? 

Mr. HUSE. The nonwork card, for example, was required as a 
means to provide legitimate visitors to this country with the ability 
to get a driver’s license and be insured and to 

Mr. JOHNSON. They don’t have to have a Social Security card 
to get a driver’s license. 

Mr. HUSE. Well, in some States you do need an SSN to get a 
driver’s license. It is the underpinning of the driver’s license sys- 
tem. 

Mr. JOHNSON. That is not the purpose of the number. So, we 
are misusing it when we use it that way. 

Mr. HUSE. The nonwork number, because there were these re- 
quirements, the SSA came up with this as a service. Now that was 
curtailed after September 11th. Commissioner Barnhart notified 
the governors of our States that the SSA would no longer do that. 
There were court challenges to that decision and the SSA has gone 
back to it temporarily, but it is under scrutiny now. 

Mr. JOHNSON. So, what you are saying is the States use the 
SSN as verification to get a driver’s license? 

Mr. HUSE. They do. It is the underpinning of our driver’s license 
system. That is why I used to use the term de facto national identi- 
fier for the SSN. If you notice over the time I have been here I 
have dropped that “de facto.” If this is truly the case, that the num- 
ber is underneath even the driver’s license, we can’t call it a de 
facto number, it is the national identifier until something changes. 

Mr. JOHNSON. Do we legislate against that? I see driver’s li- 
censes being used as fake identification, too. 

Mr. HUSE. The driver’s license is probably the most counter- 
feited identification we have. In any case there is a lot of scrutiny 
on the uses of the nonwork number. There are foreign visitors to 
this country, students that obtain the appropriate visas that are in 
this country to be educated that for Citizenship and Immigration 
Services, if I got this right. 
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Mr. JOHNSON. I know what you are talking about. When you 
issue a SSN are you verifying it by one document or several docu- 
ments? It seems to me if there is a fraudulent effort out there to 
obtain them, I don’t know where they get them all from. Do they 
just make up the numbers or are they buying them or what? 

Mr. HUSE. Thieves steal genuine numbers, thieves make up 
counterfeit numbers out of thin air and then create a myriad of 
identification from that. Between the two, all of this migrates into 
databases, and that is why I suggest that verification of these 
records is a way to root out SSN misuse. 

Mr. JOHNSON. The IRS is your primary enforcement agency 
right now? 

Mr. HUSE. It is. 

Mr. JOHNSON. It seems to me that — how are they verifying the 
authenticity of the SSN? I know there is a lot of mismatches. How 
are we fixing that and are your computers being updated as we 
speak? 

Mr. HUSE. There are efforts to do that. Our work and the work 
of the GAO have suggested system fixes to Social Security, and 
they have those in their queue to do along with their own systems 
enhancements. Those are under way. Are they done yet? No, they 
are not finished. 

Mr. JOHNSON. We talked about this at least 2 years ago. Where 
are we with reference to that issue? 

Mr. HUSE. We are moving toward the goal line, but it is not 
done yet. 

Mr. JOHNSON. Can you see the goal line? 

Mr. HUSE. Well, some things you take on faith. 

Mr. JOHNSON. More than 100 yards away. Thank you very 
much. Thank you, Mr. Chairman. 

Chairman SHAW. Mr. Becerra. 

Mr. BECERRA. Thank you, Mr. Chairman. Before I begin my 
questions, I want to thank the Chairman for continuing to press on 
this issue. I know he has had legislation in the past, and I hope 
we are able to move something. I am sure it is going to be a bipar- 
tisan piece of legislation. I thank the Chairman for his efforts on 
this particular subject. To our witnesses, thank you again for being 
here. A couple of questions. First, with regard to the maintenance 
or the integrity of the SSN itself, the war on terrorism, the need 
for more security, it is becoming more and more important now 
that we check and verify. Now, I recall before 9/11, the SSA was 
already having problems trying to find the resources to take care 
of this massive work. Can you tell us what kind of monies you have 
post-9/11, or let’s just focus on this year’s budget, what kind of 
moneys you have in addition to what you already had to try to deal 
with this issue of identity theft. 

Mr. HUSE. First of all, we do have built into our 2004 budget 
request appropriate funding to do some more significant work 
with 

Mr. BECERRA. How much are you asking for? 

Mr. HUSE. Let me look back and get a dollar. The total appro- 
priation we have asked for is $90 million, but in there, there is 
about an $8 million increase over current appropriations. We were 
looking to build out this SSN misuse capacity. 
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Mr. BECERRA. Let me make sure. Of the $90 million that you 
are asking for, $8 million of it would focus on the identity theft 
issue or all $90 million would focus on the identity theft issue? 

Mr. HUSE. The $90 million covers all of our responsibilities, 
which is beyond just this particular mission. What we were looking 
for in the $90 million is $2 million, a modest amount to develop 
what we call SSN misuse teams that we have. The teams will in- 
clude auditors, investigators and 

Mr. BECERRA. That is $2 million. Keep going. 

Mr. HUSE. That is the only growth we asked for. 

Mr. BECERRA. That’s $2 million for a country the size of the 
United States? 

Mr. HUSE. Well, we 

Mr. BECERRA. I suspect the folks that are forging these docu- 
ments could give you more than $2 million off their profits just of 
what they have made. 

Mr. HUSE. Now, I need to be careful here, because my role in 
relation to all of this is the integrity to the SSN business process 
itself. The whole issue that you speak to is a massive universe that 
involves 

Mr. BECERRA. That is very true. 

Mr. HUSE. The whole government. 

Mr. BECERRA. Outline for us what moneys you are getting for 
your particular role within the Inspector General’s office, and per- 
haps we could ask, Mr. Chairman, for the SSA to break down the 
monies it is requesting to deal specifically with the identity theft 
issue so we have a sense. I am almost positive what we will find 
is that you all need more resources, and we should know that now 
so that when you come back and testify for the 10th or 11th time, 
we won’t be asking why you haven’t made more progress along the 
yardage markers to get closer to the goal line. Another question for 
you. Do government administrators or employees today at any level 
of government, whether Federal, State, local, or any business em- 
ployees that you are aware of, undergo any training for identifica- 
tion verification to know when a document is real or fraudulent? 

Mr. HUSE. They do. Even Social Security field employees get 
training in the identification of 

Mr. BECERRA. Without going further, because I want to make 
sure I get all my questions in, if you could provide us or provide 
my office with the literature, whatever you have in writing that 
says what the training is 

Mr. HUSE. I would be glad to. 

Mr. BECERRA. If you know what other State or local govern- 
ments do as well, because I guess one of the problems is we have 
a lot of folks who aren’t trying or doing much of an effort to figure 
out if these are authentic documents or identification cards or not. 

Mr. HUSE. Sure. 

Mr. BECERRA. If someone asks for a replacement Social Secu- 
rity card — I lost my card, I write to the SSA and say I need to get 
another one, I can get one; right? 

Mr. HUSE. Right away. 

Mr. BECERRA. If a year later I write back and say, you know 
what, I lost it again. 

Mr. HUSE. You would get it again. 
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Mr. BECERRA. If I say, you know what, I ripped it up. I lost it. 
Can I get another one? 

Mr. HUSE. You can, and that goes on and on and on. 

Mr. BECERRA. Does that trigger within SSA any thought that 
perhaps this individual is misusing the SSN? 

Mr. HUSE. It does now, because we analyze the enumeration 
process, and where there are clusters of these, some are referred 
to us for an investigative look, where there is suspicion, which can’t 
be 

Mr. BECERRA. So, we are doing something? 

Mr. HUSE. Yes. Yes, we are. 

Mr. BECERRA. Thank you, Mr. Chairman. 

Chairman SHAW. The replacement card has the same number, 
doesn’t it? 

Mr. HUSE. Yes. 

Chairman SHAW. Your concern with the replacement card is 
they are just handing them off to their buddies. 

Mr. HUSE. Correct. We have, in some instances, where people 
get hundreds of these in a year, or almost 100 in a year. 

Now, some people may be generationally used to the fact that 
they think they have to have this card at all times. Some of us get 
older, and we forget, misplace them and we think we have to get 
another one, and that is a service. That is a service some people 
believe they have to have, so a lot of these really aren’t criminal, 
but when you see 80 or 90 a year, you begin to wonder, and those 
we are now 

Mr. BECERRA. I’d think you would begin to wonder before 80 
or 90. 

Chairman SHAW. Mr. Collins. 

Mr. COLLINS. Maybe we ought to flag those and send them to 
them in bulk. I was just looking at some information the Sub- 
committee provided for us on mismatched records to see where the 
Social Security matches information with the IRS weekly about, 
and that is W-E-E-K-L-Y, not W-E-A-K-L-Y, about discrep- 
ancies. Interesting figures that no match letters were sent out to 
employers for employers to actually verify the employee, that it 
went from 110,000 to 950,000 letters last year, representing 10 mil- 
lion mismatches. Now, to go back to what Mr. Johnson was talking 
about, the immigration bill, and you talked about earlier, the raid 
that you all were successful with this morning in California where 
you apprehended three and one is on the loose. A lot of the cards 
or the material they had there to create cards will be part or a 
large part of this mismatch? 

Mr. HUSE. There is absolutely no doubt that there is a demand 
for counterfeit identification documents brought on by our undocu- 
mented worker population in this country. That is fact. 

Mr. COLLINS. A driver’s license or most any kind of identifica- 
tion that has a SSN on it also has a photo on it. Any thoughts to- 
ward a photo? You get a SSN as an infant, but once you reach legal 
age, some age 

Mr. HUSE. There is no plan to do that. In fact, at the present 
time the SSA does not require a photograph for any of Social Secu- 
rity’s services, including any of the insurance programs. Your num- 
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ber is the key that unlocks those benefits. In addition, there is not 
any biometrics involved. 

Mr. COLLINS. It is also becoming a key to a lot of other folks 
too, using it in a wrong pattern. What can an individual — what has 
the Administration done to assist an individual in how to be more 
responsible or protective of their SSN? 

Mr. HUSE. I can speak to what we, at SSA, and what I know 
from the FTC, and they have done extensive outreach work and ac- 
tivity in their communications arena to apprise people of the issues 
involved and the personal responsibility to protect your number, 
what to do when something happens to you, when you detect some- 
one else has used your number and what remedies to take, and 
those are very understandable brochures and mailings. We have a 
fraud hotline at SSA that provides these answers to hundreds of 
people that call in with these problems. The FTC does the same 
thing. We also tell people in the process of getting their statement 
on Social Security every year, which is very important, that is a 
critical document, just like your monthly credit card statements, 
that you should review it carefully to be sure that the wages and 
earnings that are posted on it track with your recollection of your 
earnings history, because if there are differences there, that is al- 
most a sure sign there has been a compromise of your identity. The 
other thing that SSA has advised people for some time now is to 
cease the practice of putting your SSN on private checks, and that 
is just not necessary. You shouldn’t put your phone number either. 
This is just a desire by businesses to gather some data on folks 
that they don’t really need to have. 

Mr. COLLINS. Thank you. Thank you, Mr. Chairman. 

Chairman SHAW. You had a follow-up on — go ahead and then 
we will go to Ms. Tubbs Jones. 

Mr. JOHNSON. Thank you. I would just like to ask, in the mili- 
tary, they ask you for your SSN. That is why we used to put them 
on the checks. I don’t anymore. 

Mr. HUSE. I remember, too. 

Mr. JOHNSON. That, and phone number. That as well. 

Mr. HUSE. So, they could get your officer’s club bill to you. 

Mr. JOHNSON. That is so you would pay them. That’s right. I 
would like to ask a question real quick. Kids that get — when you 
give a baby a SSN, he isn’t going to work. Why does he need one? 
The IRS asks you to do that, didn’t they? 

Mr. HUSE. They did. 

Mr. JOHNSON. They use it, and it is if that is where how much 
of the fraud do you know what percentage of the fraud is in young 
kids? 

Mr. HUSE. Well, the fraud that happens with the young children 
is when parents of young children get earned income credits for the 
purpose for 

Mr. JOHNSON. Kids get earned income credits? 

Mr. HUSE. No. The parents do for the number of children they 
have, depending upon the level of the parent’s income. That is a 
type of fraud. We can get you some information on that. 

Mr. JOHNSON. Well, why isn’t it possible to give a child a num- 
ber that is not a SSN, that the IRS can use until they get of work- 
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ing age? We have child labor laws too. They are not supposed to 
work under a certain age. 

Mr. HUSE. Like many things in government, this was a process 
that emerged out of a need to prevent fraud in filing income tax 
returns, where people claimed 

Mr. JOHNSON. It has turned around on us and we are having 
fraud develop in the Social Security regime. Then we maybe need 
to look at that again. 

Mr. HUSE. That could be a possible area for adjustment. I know 
of the time in my youth you didn’t get a number until you went 
to work. 

Mr. JOHNSON. That’s right. Thank you. Thank you, Mr. Chair- 
man. 

Mr. COLLINS. That may be part of the problem with the $10 bil- 
lion of fraud that we have with the earned income tax credit each 
year. 

Chairman SHAW. Ms. Tubbs Jones. 

Ms. TUBBS JONES. Thank you. Do you have any indication that 
there is more abuse by earned income tax credit people filing than 
there is abuse of fraud in businesses across the country? 

Mr. HUSE. No. 

Ms. TUBBS JONES. Thank you. Let me go on. I heard you ear- 
lier raise the question that or say that there is no way you could 
prosecute Ms. — I don’t know how to pronounce your name. 

Ms. BOVBJERG. Bovbjerg. 

Ms. TUBBS JONES. Thank you — for selling her SSN to you. 

Mr. HUSE. You could prosecute her, but you couldn’t prosecute 
me if I sold my number to her. 

Ms. TUBBS JONES. Why not? 

Mr. HUSE. There is no penalty for me to sell my genuine SSN. 

Ms. TUBBS JONES. Oh, absolutely. There is a penalty for theft 
and deception and fraud. 

Mr. HUSE. I meant in the Social Security Act (1935, 49 Stat. 
620). 

Ms. TUBBS JONES. I want you to be clear on that, because 
there is a law that covers that conduct. 

Mr. HUSE. I believe there is a law on the books for just about 
every particular aspect of this, but it is sorting through those to get 
to the right penalty that makes it very difficult. 

Ms. TUBBS JONES. Let me tell you the reason I raise the ques- 
tion with you, sir, is I am a former judge and a former prosecutor, 
prosecuted cases for Cuyahoga County for 8 years with 300 and 
some assistants, and the thing I worry about is us always trying 
to create another crime to prosecute conduct that can be prosecuted 
under existing law, and I just wanted the record to be clear that 
there is a law that you can be prosecuted for engaging in that con- 
duct. 

Mr. HUSE. I am sure. 

Ms. TUBBS JONES. Let me ask you also. You said that you 
have been here nine times. My first time meeting you, it is nice to 
meet you. Have you, in the nine times that you have been here, re- 
quested sufficient dollars to be able to do the type of work that the 
SSA needs to do to adequately protect the people of the United 
States and their numbers? 
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Mr. HUSE. Yes, I think I have done that. 

Ms. TUBBS JONES. So, the $2 million you asked for is sufficient 
to cover the needs of the SSA to help deal with this issue? 

Mr. HUSE. To clarify, that was to add to what we already have 
received through the support of this Subcommittee and the House 
Committee on Appropriations over time. We have come some dis- 
tance in the last 8 years from a very small organization to a very 
respected law enforcement organization. Most of which has oc- 
curred through the good will of this Subcommittee, and the Com- 
mittee on Appropriations. 

Ms. TUBBS JONES. I think you are being generous to the Sub- 
committee, and to yourself, to say that you have asked for enough 
money, because if you had asked for enough money, hopefully we 
would be further along than we are; and I don’t mean to be accusa- 
tory, but I am just suggesting to you that prosecuting white-collar 
crime costs much more money. It costs many more law enforcement 
folks. It costs a lot more time than prosecuting a robbery or a bur- 
glary, and so the reality is that in order to be able to do some of 
the things that you really need to do to protect the people of the 
United States and their SSNs, you probably haven’t asked for 
enough money, and you may be thinking that, well, they are prob- 
ably not going to give it to me anyway, so I am not going to ask 
for it, but I would suggest to you that perhaps that might be, you 
might ratchet up that request so that if all of us, as Members of 
Congress, are sincere about trying to alleviate this problem for the 
people of the United States, we would put our money where our 
mouth is. That is all I am saying to you. 

Mr. HUSE. I would say thank you, then. I will take your counsel. 

Ms. TUBBS JONES. I appreciate it. Let me also, just one more 
area, Mr. Chairman. Commissioner, you say on page 5 that I asked 
the Commissioner of Social Security to use the ad hoc authority 
vested in the Commissioner by SSA regulations to permit me to 
share SSA information with our law enforcement partners. Can you 
tell me what that ad hoc authority is, please, sir? 

Mr. HUSE. Well, it is authority that allows the Commissioner to 
disclose SSA information if not prohibited by Federal law. 

Ms. TUBBS JONES. Why then, if you have that extraordinary 
authority under the ad hoc authority vested in the Social Security 
administrator, do you need statutory authority to enable the In- 
spector General to make such disclosures when necessary to protect 
human lives without formal authorization from the Commissioner? 

Mr. HUSE. Well, this authority, because it is extraordinary, is a 
special and time-consuming process. Often the emergency is very 
time-restricted, where even seconds count, and that is the reason 
for this proposal in a simple statement. 

Ms. TUBBS JONES. Under that authorization, what would be 
the circumstances upon which you would want this legislation to 
authorize the Commissioner to receive the — to be able to give up 
my SSN? 

Mr. HUSE. It is actually the data that is in, they would be ex- 
tremely limited to those, and it would be based — it is a discre- 
tionary authority. It would be based on my judgment, which I 
would have to answer for, as I do now to the Commissioner. 
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Ms. TUBBS JONES. So, if you can do it already, I guess my 
problem is in the name of terrorism, we have caused so many of 
the rights of the people of the United States to be abridged, and 
I am all for going after the terrorists and I am all for law enforce- 
ment having what they need to do their job and just for back- 
ground, I am a former judge and I used to issue search warrants 
all of the time. I just fear the process of enlarging opportunities to 
give away a number that we are worried about giving away and 
we can’t control government, so forth and so on, in the name of sav- 
ing lives, per se. I would just suggest that it would be a good idea 
when we go through this process that we are real clear if we give 
away that authority that if he already has it in an ad hoc author- 
ity, maybe we might change the process but not expand it. 

Mr. HUSE. That is what we seek in this legislation. The same 
restrictions would apply. We are merely moving the process from 
the Commissioner to the Inspector General, who, like the Commis- 
sioner, is Presidentially appointed and confirmed by the Senate. 
This proposal would just move the process into the law enforce- 
ment function in Social Security. The same rules would apply. 

Ms. TUBBS JONES. There may be some advantage of having 
some oversight. That is why the law enforcement has to go to the 
judges to get search warrants, but I don’t want to argue with you 
about it. What I would like to see, though, is the proposal that you 
have for the change in that authority. I thank you very much for 
your time, sir. 

Mr. HUSE. Thank you. 

Ms. BOVBJERG. Could I add something to that, please? Ms. 
Tubbs Jones, the Chairman has asked GAO to look at Social Secu- 
rity’s policy with regard to sharing information with law enforce- 
ment. We are comparing it to the terms of the Privacy Act and to 
the policies of other Federal agencies. In this work, we are really 
looking at the balance between the privacy associated with the per- 
sonal data that the SSA maintains and the needs of law enforce- 
ment, and of course we have been working with Mr. Huse and his 
office on that. We will be reporting out in September. 

Ms. TUBBS JONES. I would be interested in hearing from you 
as well, and I would say the same thing to you, to you and anyone 
else looking at that area, that in the name of terrorism, we have 
abridged a whole bunch of rights. Let’s think about it before we — 
especially to an area that has given us so much dilemma so far. 
Thank you, Mr. Chairman. 

Chairman SHAW. Mr. Becerra asked for another follow-up ques- 
tion. 

Mr. BECERRA. Thank you, Mr. Chairman. Quickly, if either of 
you, any of the three of you could respond to this, the breeder docu- 
ments, I think at the end of the day we all recognize that as much 
integrity as we may put into the SSA’s process for issuing cards, 
if the breeder documents that are used to obtain the SSN and card 
are fraudulent, that are very good fraudulent numbers or cards, 
identifiers, then we are still in the same place we were before. So, 
how — what can we do? Is there a carrot-or-stick approach that we 
can use to get the underlying State or local authorities who issue 
identifiers that are used often to obtain a SSN or any other private 
sector industries or businesses that issue identifies that are also 
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used, health care, health insurance card, for example, which is 
often used or accepted by some as an identification card. How can 
we make sure that those breeder cards or identity cards can be 
made more authentic? How can we provide the integrity in that 
process? 

Ms. BOVBJERG. Well, third-party verification is really impor- 
tant. What we observed in the case of the driver’s licenses, was 
that the third-party verification wasn’t looking in the right place, 
so it was incomplete. In the other case, the SSN they weren’t 
checking. There wasn’t a verification of the birth record to see that 
the child didn’t exist. 

Mr. BECERRA. On that point, say the two faulty Social Security 
cards you got were verified by the SSA, so even if you take a State 
driver’s license from whatever State and ask the State adminis- 
trator, can you verify if this is a true identifier for you, is it an au- 
thentic State driver’s license, someone might say, yeah, because it 
is such a great fake, forged document. So, how do you stop the 
process of creating what are clearly very good forgeries? 

Mr. BERTONI. I will take a shot at that. We have criss-crossed 
the country looking at the processes for driver’s license as well as 
SSNs, and I reiterate what Barbara says. We really need a system 
where we can have some independent third-party verification. So, 
if I am coming to the table with documents that look really good, 
even with training, and other tools that a driver’s license clerk is 
given, or an SSA person is given, the documents are often just too 
good to catch. You really need to corroborate this information with 
third-party sources. In the case of the SSN, if I were to bring a 
birth certificate, SSA staff should bump that against State Bureau 
of Vital Statistics information from the issuing State. There are a 
number of other data sources that SSA could use to corroborate the 
name, date of birth, Social Security, and other elements. If the data 
comes back matching and you have other documents that corrobo- 
rate the rest of the story, then you have a comfort level and you 
can issue the document. The same is true for driver’s licenses. If 
you are a State using SSA’s online process, you are going to get the 
full, I guess, the plate of services from SSA, including the death 
match. States that use a batch process, are not getting that match 
and if persons come to the table with a name, date of birth and 
SSN of a dead person and it is on the documents, SSA could do 
that check. I am sorry. The Department of Motor Vehicles could 
check with SSA, and it would still come back verified. 

So, again, it goes back to what third-party verification are States 
doing, and what is the quality of that third-party verification. An- 
other aspect is that if not SSA, or another government agency, 
some States use private vendors to perform data mining, and data 
cross-matching across the public and private sector sources to give 
the person that is verifying your identity documents greater com- 
fort level that you are who you say you are. This brings me to the 
issue of how extensive identity theft is, and I will use the driver’s 
license example. We took 1 month of transactions from 1 State and 
matched that data against SSA’s master death file and got initially 
160 instances where it looked like someone had used the identity 
documents of a deceased individual. We immediately forwarded 44 
good ones to the State of issuance, because these folks were dead 
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10, 15, or 20 years, and it looked like identity theft was likely. We 
got a quick response back from the State that they had issued a 
license or identification card to 41 of 44 of these people. So, one 
State, 1 month of data show that this is a problem. There are a 
lot of States out there, and identity information is being used over 
and over and over again. I think there are driver’s licenses out 
there that are issued to folks who shouldn’t have them, and I think 
the problem is bigger than we all think it is, at least in the driver’s 
license area. 

Mr. HUSE. That is why, to sum this up, I think there are so 
many benefits to the cross-verification of data. Some privacy, of 
course, will be abridged, but anomalies will be reduced that every- 
body, whatever sector they are from, government, commercial, fi- 
nancial, will have to deal with these anomalies. These people were 
dead people that basically were used to produce this, we need to 
get a control over, it is not just government’s problem. It is a uni- 
versal problem. It will never, ever be perfect. That is a fact. There 
is nothing that can’t be counterfeited. One day, though, all of this 
will lead us to a place where we will go to biometrics. We have to. 
That is not my role to suggest that. I just know that that is the 
ultimate answer. 

Mr. BECERRA. It sounds like what you are saying is, if it is 
going to gain better protection of our privacy, we may have to give 
up a little bit of privacy 

Mr. HUSE. We may have to give up a little. It is this willingness 
to have our records cross-checked against 

Mr. BECERRA. This cross-checking isn’t cheap. It is 

Mr. HUSE. No. It is expensive. 

Mr. BECERRA. Mr. Chairman, thanks for the time. 

Chairman SHAW. I think also by limiting the use of SSNs, we 
are actually going the other way. We are pulling back and we are 
increasing the right of privacy, which is something that we seem 
to be losing a little bit, as Ms. Tubbs Jones was pointing out, be- 
cause of 9/11. I cannot remember a single time that I have been 
asked, somebody has asked to see my Social Security card. I am 
constantly asked for a SSN, and I have gotten to be, whether it is 
an application or something like that, I will just leave that blank, 
and usually nobody ever follows up to ask for it. This is something 
we have certainly got to do something about. When you think about 
the number one identifier in this country today is a card with a 
name and a number on it, period, no description, no date of birth, 
nothing else involved in it and this is being used as a prime identi- 
fier, there is something wrong with that picture and something we 
need to work on. We are just so vulnerable with regard to the use 
of those, and those numbers really have to be protected. Someone 
was — I think Mr. Johnson brought up the question that and you 
can see on that board to the right where the military identification 
uses the same numbers as Social Security. 

Mr. HUSE. Exactly. 

Chairman SHAW. Rank, name, and serial number. I used to kid 
Mr. Johnson. I would say, when you were in prison in Vietnam, the 
Vietnamese have your SSN, because that is the serial number, and 
when you go to many of the PXs on Army bases or any military 
base, you try to give them a check and not put your serial number 



38 


on it, they won’t take it, and that means that they are getting the 
SSN, and we had testimony a few years ago, I think it was a colo- 
nel whose credit was absolutely destroyed because of, because 
somebody somewhere in the chain from the PX to the bank had 
picked up his SSN and just used that as the jumping off spot in 
order to assume his identity. We have, at this point, a vote on the 
floor. I think it is a point of order, and I assume that 

Ms. TUBBS JONES. Mr. Chairman, since we have a vote, can I 
ask just one other question, real short? 

Chairman SHAW. Your questions go on for a long time. 

Ms. TUBBS JONES. I know. 

Chairman SHAW. I have got the gavel. You are 

Ms. TUBBS JONES. Okay. I won’t have any problem. Just gavel 
me. By the time someone realizes that there is an identity theft 
problem and they go to law enforcement, the track is pretty cold, 
isn’t it? 

Mr. HUSE. Very often, yes. 

Ms. TUBBS JONES. See. I am done, Mr. Chairman, and you 
didn’t even know it. 

Chairman SHAW. Very good. That is a record. I am a little con- 
fused about exactly how long we are going to be gone, but we will 
be coming back and go into the second panel immediately upon our 
return. So, I appreciate your patience in dealing with the schedule 
that we have. We will be in recess until approximately 10 minutes 
after the next vote. 

[Recess.] 

Chairman SHAW. We are going to go ahead and start. One of 
our witnesses has not returned as yet, but the vote has been over 
for a few moments and Mr. Collins is coming in now. So, we are 
going to go ahead and start with the next panel. We have Theodore 
Wern who is the Chicago, Illinois Regional Coordinator, the Iden- 
tity Theft Resource Center in Chicago. Chris Hoofnagle, who is the 
Deputy Counsel, Electronic Privacy Information Center. We have 
an additional witness from Georgia, whom Mr. Collins will intro- 
duce when he returns. Mr. Wern. 

STATEMENT OF THEODORE WERN, CHICAGO AND ILLINOIS 

REGIONAL COORDINATOR, IDENTITY THEFT RESOURCE 

CENTER, SAN DIEGO, CALIFORNIA 

Mr. WERN. Thank you. Good afternoon. My name is Ted Wern, 
and I am the Midwest Regional Coordinator for the Identity Theft 
Resource Center. I am also an attorney in private practice in Chi- 
cago, Illinois. I began my work with the Resource Center after I re- 
covered from my own personal identity theft problems. My battle 
lasted about 3 years, and from that process, I learned what mil- 
lions of Americans have learned — that identity theft can truly 
wreak havoc on a person’s life. What I have also learned as an at- 
torney and as an educator to corporations in this area is that iden- 
tity theft can result in some very significant liabilities for corpora- 
tions. Therefore, my role both as an attorney, and as a volunteer 
for the Resource Center is to ensure responsible information han- 
dling, both for the benefit of potential individual victims as well as 
for the benefit of institutions which face potential liability in this 
area. Next I would like to provide a real-life perspective on the 
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problem of identity theft by talking about a small sample of cases 
that the Identity Theft Resource Center has handled in the past, 
keeping in mind that they handle thousands of cases each year, 
and these are just a few that seem particularly relevant to this 
hearing. 

The first case involves a widow of the September 11th attacks. 
Approximately a year after her husband died in those attacks, she 
found out that her deceased husband’s SSN was being used by an 
illegal immigrant for both fraudulent credit purposes and employ- 
ment purposes. We don’t know exactly how that person got the 
SSN, but public death records, which often display SSNs, are prob- 
ably a very good guess. We also handle numerous cases involving 
the theft of children’s identities. Mr. Johnson had a concern about 
this, and in response to that, children are becoming a new target 
of identity thieves. Here is why. Basically, a child’s SSN and per- 
sonal information can be stolen when the child is young, 6, 7, or 
8 years old, by either a family member or stranger. By the time the 
child finds out, i.e., when the child is 18 or 19, or after adult age, 
to apply for credit or sign a landlord lease, by that time the thief 
has had 15 or 12 years to use that information to his or her advan- 
tage. So, the reason the children are such a hot target is because 
there is this lengthy discovery period for the crime. 

The other group of cases to talk about, and one stands out in 
particular, involves military personnel. I would like to highlight a 
case that was the centerpiece of the Parade Magazine issue that 
comes in your Sunday newspapers. It was issued just this past 
Sunday. It involved a man named John Harrison who was a retired 
Army captain. His name and SSN and other personal information 
were stolen and used by a man who was able to buy, for example, 
a Harley Davidson, who was able to rent an apartment, was able 
to buy a timeshare, and the list goes on and on, all with Mr. Har- 
rison’s name. The importance of this article, and the story is that 
within hours of this article hitting the news stands, the Resource 
Center was flooded with calls and e-mails from citizens who were 
concerned about their identities, and the vast majority of those citi- 
zens were elderly persons, military personnel, and people who were 
concerned about their SSN appearing or being displayed on their 
military identification cards, which is a common practice, Medicare 
identification cards and of course, health identification cards as Mr. 
Cardin showed us a few moments ago. 

The common thread from all of these cases is the fact that the 
SSN is at use in all of them. Without the SSN being available to 
criminals, none of these cases would have been possible. I would 
love to give you hard data about how many thieves extract their 
SSN from particular sources, whether they be death records or gov- 
ernment records, but the data just isn’t available, because, one, 
thieves rarely get caught; and two, when they are caught, their sto- 
ries about where they got the information are hardly credible. 
What I can tell you, however, is that the SSN is the golden piece 
of data for identity thieves. A thief can only go so far with a date 
of birth or with an address. The SSN rounds out the crime, and 
with it, along with other information, getting fraudulent credit is 
as easy as picking up the phone or signing up on the Internet. So, 
even though we don’t know exactly how the thieves are getting the 
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information, what we do know is that the number itself is worthy 
of any protections, any confidentiality restrictions that the govern- 
ment or the private industry can impose on it. 

Let me point out that our goal here is not to create an undo bur- 
den on industry. We have looked at this bill, and we believe that, 
as Chairman Shaw indicated earlier, that it is a balancing act. You 
have to look at the potential benefits of the bill weighed against the 
burdens. In this case, we believe after careful study that the bene- 
fits of this bill far outweigh the potential burdens. With regard to 
that balancing, first of all, the SSN has no intrinsic value to gov- 
ernments or private industry. What I mean by that is that you 
don’t use a SSN to dial up a person at home. You don’t send mar- 
keting materials to a SSN. It is a random number, the only signifi- 
cance of which is to identify the particular person. There is no in- 
trinsic value in the number itself. So, as Mr. Cardin raised before, 
why is his number and my number on our health identification 
cards? So that our doctor can have an emergency response number 
to call us or so that our medical records can be sent to that num- 
ber? No. It is a random number, and there are plenty of other ran- 
dom numbers that could replace that number. So, especially in the 
area of publicly displaying these numbers on identification cards, 
unless it is for a legitimate IRS purposes or some of the exceptions 
that you have laid out in your bill, but for general commercial pur- 
poses like this, it just makes no sense. It is a random number. Why 
not get it out of circulation? 

Also, with regard to balancing, it is important to point out that 
this is not a bill that imposes huge financial or administrative bur- 
dens on the industries or the government agencies that are sub- 
jected to it. We are not talking about huge capital expenditures 
here. We are not talking about complete overhauls to data systems. 
There are simple practical solutions of taking this number off the 
market, basically removing it from circulation. Furthermore, with 
regard to costs and benefits, there is an economic benefit for cor- 
porations and government agencies to not having that number out 
there for two reasons. One, there is a serious source of liability for 
corporations and government agencies who are responsible for in- 
formation getting out into the public and identity thieves grabbing 
it. For example, when you have a large identity theft situation and 
outbreak, there is enormous class action potential in that situation, 
and these sorts of cases are growing exponentially in the market- 
place today. So, this bill, in fact, is doing what exactly some of my 
clients, when we give our corporate workshops, are asking us to 
help them do, and that is help them to remove sensitive informa- 
tion from public display within their organizations, because they 
are very concerned about this source of liability. Finally, very obvi- 
ously, as you reduce identity theft, you reduce direct losses to mer- 
chants, to banks, to credit card companies, and the losses in the 
last year we estimated at $17 billion. We took the average direct 
loss of an identity theft victim, losses that are borne by credit card 
companies and other creditors, multiplied it by the number of esti- 
mated victims which are between 700,000 and a million last year. 
Those are real numbers. So, not only do you have — if you can pre- 
vent identity theft, a prevention of liability. You also have a pre- 
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vention of direct losses. So, with these points in mind, I think the 
balancing act strongly favors this bill. 

[The prepared statement of Mr. Wern follows:] 

Statement of Theodore Wern, Chicago and Illinois Regional Coordinator, 
Identity Theft Resource Center, San Diego, California 

“Identity Theft and the Social Security Number” 

Members of the committee: Thank you for the opportunity to provide both written 
and oral testimony for your committee today and for your interest in the topic of 
identity theft. 

The Identity Theft Resource Center (ITRC) is passionate about combating identity 
theft, empowering consumers and victims, assisting law enforcement, reducing busi- 
ness loss due to this crime and helping victims. Our organization is honored by your 
invitation and will continue to make its opinions available upon request to your rep- 
resentatives over the next few months as you grapple with this complex crime. The 
following testimony was written along with ITRC’s executive directors, Linda and 
Jay Foley, and I have their permission to represent ITRC today at this hearing. 

About ITRC and the experts testifying: 

ITRC’s mission is to research, analyze and distribute information about the grow- 
ing crime of identity theft. It serves as a resource and advisory center for con- 
sumers, victims, law enforcement, legislators, businesses, media and governmental 
agencies. 

In late 1999, ITRC Executive Director Linda Foley founded this San Diego-based 
nonprofit program after becoming a victim of identity theft. In her case, the perpe- 
trator was her employer. Co-Executive Director Jay Foley has spent hundreds of 
hours speaking and corresponding with thousands victims while assisting in their 
recovery, listening as they discuss their revictimization by “a system that doesn’t 
care, understand or listen.” 

ITRC also works with credit grantors, representatives from the credit reporting 
agencies (CRAs), law enforcement officers, governmental agencies and private busi- 
nesses to prevent and resolve identity theft problems. 

As one of the few groups that deal with a victim at all stages of the recovery proc- 
ess, we have a unique perspective on the crime. ITRC’s information does not arise 
only from moment of discovery statistics. Its information comes at the cost of min- 
utes, hours, days, weeks, months and years of a victim’s life. 

I (Theodore Wern) was an identity theft victim and serve as the ITRC Chicago 
and Illinois Regional Coordinator and victim advocate. My own case was com- 
plicated and required me to go to the extreme measure of changing my Social Secu- 
rity Number (SSN) in order to stop the crime from continuing. Because of my expe- 
riences, I am one of ITRC’s designated specialists in severe cases. Since I work with 
others who must also change their SSN (only recommended in extreme situations), 
I serve as one of ITRC’s representatives on a taskforce with the Social Security Ad- 
ministration (SSA) on defining and smoothing the procedures for changing one’s 
SSN in extreme cases of id theft. My expertise as a corporate attorney also gives 
me added insight into the business implications of using the SSN as an identifier, 
as well as liability issues surrounding this subject. 

The ITRC has worked for a number of years to make changes in laws, policies, 
business practices and trends to combat this crime. As a result ITRC has composed 
a list of recommendations that we feel will make a difference both in crime preven- 
tion (keeping the information from the hands of criminals and preventing the 
issuance of fraudulent credit) and in victim recovery. 

ITRC’s Testimony: ITRC has been asked to address the following points: 

• The problem of identity theft including its impact on victims 

• Issues surrounding the use and abuse of the SSN 

• Recommendations for new laws regarding the SSN, including those listed in the 
Social Security Number Privacy and Identity Theft Prevention Act of 2001 (H.R. 
2036). 

Part One: Summary of the Problem 

H.R. 2036 succinctly summarizes the history of the creation of the SSN and how 
this Pandora’s box was opened. Unfortunately, in 1943, President Roosevelt could 
not have predicted the impact of the information age and the role computer tech- 
nology would play in our lives. He could not have foreseen how it would change 
business practices or expose United States citizens to a harsh crime — that of finan- 
cial identity theft. 
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Identity theft is not a new crime. The crimes of criminal identity theft and iden- 
tity cloning (the use of another person’s name instead of your own) can be traced 
back to biblical times. Credit card fraud and checking account fraud began soon 
after the advent of those financial transactions. 

As stated in Mr. Shaw’s summary, the Federal Government requires virtually 
every individual in the United States to obtain and maintain a Social Security ac- 
count number in order to pay taxes, to qualify for Social Security benefits, or to seek 
employment. The use of this number as an identifier has grown tremendously and 
it is now common practice to use the SSN for purposes that have nothing to do with 
the extension of credit or governmental purposes. This extensive use of the SSN pro- 
vides criminals with easy access to fresh credit and a new identity. To an identity 
thief, a victim’s name, date of birth and address can be valuable, but such data 
alone is often not sufficient to commit identity theft. A thief generally needs a SSN 
as well. Because the SSN is “golden data” to the identity thief, it should be given 
the greatest privacy protections. 

As pointed out in Mr. Shaw’s summary: 

• An individual’s Social Security account number may be sold or transferred with- 
out the individual’s knowledge or permission. 

• Today, the Social Security account number is generally regarded as the single- 
most widely used record identifier by both government and private sectors within 
the United States. 

• No one should seek to profit from the sale of Social Security account numbers 
in circumstances that create a substantial risk of physical, emotional, or finan- 
cial harm to the individuals to whom those numbers are assigned. 

• The prevalence of the use of the Social Security account number and the ease 
by which individuals can obtain another person’s Social Security account num- 
ber have raised serious concerns over privacy and opportunities for fraud. 

• Social Security cards may be counterfeited for illegal aliens and individuals use 
false Social Security account number information to improperly apply for and 
receive benefits under Federal and State programs. 

• Misuse of the Social Security account number is a central component of identity 
theft, considered the fastest growing financial crime in the country as well as 
welfare and Social Security fraud. 

• Growing concern over fraud and privacy and the absence of a comprehensive 
Federal law regulating the use of Social Security account numbers prompt the 
need for the Congress to act. 

ITRC does not believe it will be possible to completely eliminate this crime but 
we certainly hope to do the following: 

• Make it extremely difficult for criminals to obtain SSN and other information 
that can be used to commit financial identity theft by severely cutting back on 
the exchange of such information. 

• Tighten the procedures used by the issuers of credit so that criminals have a 
more difficult time in using ill-gotten information. 

• Assist in victim recovery and shorten the time and duress suffered by its vic- 
tims. 

Because the federal government, through the SSA, created and maintains SSNs, 
it is appropriate for the federal government to take steps to stem the abuse of SSNs 
both in private industry and by governmental agencies. It will be far more efficient 
for the federal government to pass regulations about the use and misuse of the SSN 
than to rely on state regulations. California has come a long way in addressing the 
abuse of the SSN but to do this in 49 more states would be a daunting task. 

Part Two: Victim Impact 

Identity theft is a dual crime and no one is immune, from birth to beyond death. 
Who are these victims? It could be you, unknown to you at this very moment. I’d 
like to introduce you to some of ITRC’s clients/victims who have turned to us for 
assistance. Many of these cases are taken directly from emails ITRC has received 
from victims. We present them to you so that you can see what we work with on 
a daily basis. Personal identifiers have been changed to protect each victim’s privacy 
and some grammar/spelling corrections have been made. 

Case 1: Child ID theft 

The victim, Jose, owes about $65,000, $4,700 in child arrears and has 3 DUI war- 
rants in his name. One problem: Jose is only 6 years old now and those arrears are 
to himself. The perpetrator is his father, now divorced from Jose’s mother, an illegal 
immigrant who is subject to deportation when found. 
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Case 2: Identity theft of the deceased 

Perhaps one of the most poignant stories we have heard (NJ Star Ledger reported 
it) is the theft of a man’s identity who died in the World Trade Center attack on 
Sept. 11 th . His widow was notified about 10 months after the event to discuss her 
husband’s recent auto accident. She went through hours of turmoil only to discover 
that an illegal immigrant had created a false driver’s license and was living and 
working as her deceased husband. 

Unfortunately this is only one of more than several dozen cases that we have 
worked on involving the deceased. In some cases the imposter has purchased the 
information, in others the imposter is a family member or even a caregiver. Some 
may ask what is the harm in using the SSN of the deceased. Not only can identity 
theft involving a deceased person affect the estate but also the survivors still deal- 
ing with the grief of losing a loved one. In one other case, a mother has had to fight 
collectors trying to collect money from accounts opened in her daughter’s name, a 
daughter who died several years ago. Each new call opens up the wound again. 

Case 3: Workplace identity theft 

T’s identity was stolen by her doctor’s receptionist. She found out when applying 
for her first home loan, her dream home. Months later, after clearing her records, 
spending her own time to research how her thief got her information and used it, 
and seeing another family move into her home, she was able to convince authorities 
to prosecute her offender. The result — the thief is now living in a halfway house, 
driving the car she bought with T’s identity and working for another doctor as a 
staff member. T was finally able to buy a house almost 2 years later, at a higher 
purchase cost, with a higher interest rate due to the multiple accounts that had 
been opened in her name after the placement of a fraud alert. 

Case 4: Victim recovery issue 

Victim owns her own business. For the past 3 years, she has been in a fight with 
her bank. They repeatedly open new fraudulent accounts in her name and grant 
fraudulent access to her existing accounts, even generating dual credit cards and 
sending them to the imposters as well as herself. At one point she went to the local 
branch of her bank regarding the transfer of her account information. With multiple 
pieces of identification in her possession she was devastated by the bank officers 
who would not acknowledge her right to discuss the accounts in question or accept 
her identifying documents including passport, driver’s license, utility bills, business 
license and SS card. To date she still has problems with her bank and her accounts. 
She is currently talking to an attorney and plans to sue the multiple companies who 
continue to torment her and refuse to correct their errors. She believes that lawsuits 
are her only option left. 

Case 5: Financial id theft turns into criminal case 

Two nights ago, I was arrested as part of a 4-year ongoing theft of my identity. 
The arrest was over bad checks written in Lincoln, NE near where I reside. 

The issue, other than the arrest and all that goes with it, is the fact that J.P.M. 
was able to open fraudulent accounts because the Nebraska DMV issued her a li- 
cense with her picture and my information. I don’t know what documentation she 
provided them, but we clearly do not have the same physical features. This should 
have sent up a red flag to the DMV. As a result, J.P.M. illegally used my identity 
to spend almost $40,000, with new credit cards and with fraudulent checks. 

I am doing the best I can to be compensated for the money spent on bail, loss 
of work time, personal stress, which all occurred while I was finishing my under- 
graduate degree and throughout my master’s degree. Needless to say, this has inter- 
fered with my performance in school because of the time it takes to free myself as 
a citizen and as a consumer. The arrest was the last straw, and I’ve been told that 
the statute of limitations to sue the woman who stole my identity has expired. I 
am looking for help. 

Case 6: SSN used as driver’s license number 

Victim had car broken just prior to a move from HI to DE. A file with all of her 
personal information was stolen in HI including her driver’s license that used her 
SSN as the identity number. Since then a fraudulent cell phone account was setup 
with Voicestream generating a bill for $10,000.00. The victim has made some pay- 
ments during the course of the account dispute due to the bullying action of collec- 
tors threatening to attach to possessions. Because of that payment, Voicestream re- 
fuses to acknowledge the account is fraudulent. 



44 


Case 7: Security breach 

Victim was referred to ITRC by the FBI Victim/Witness Coordinator. The victim 
is a 72 year old retired Air Force Major. His dentist told him his identifying infor- 
mation might have been stolen. The dentist had befriended a man who saw the vic- 
tim’s dental records. This man then copied and used all of victim’s info. The dentist 
found out when he saw files out of place. This befriended man/handyman was the 
only person who had access. The imposter purchased a condo, a BMW, and used the 
victim’s HMO for medical services. The victim’s HMO paid for this. Upon arrest, it 
was discovered that the imposter had a prior record of fraud. The imposter is now 
in jail on non-related charges. 

Case 8: Identity Cloning 

Victim lives in San Diego and is receiving disability benefits. The imposter is liv- 
ing and working in IL. Fraud is impacting her disability benefits. The IRS and SSA 
have been contacted. Victim is fearful of losing housing and being unable to cover 
living expenses due to the lengthy time of recovering her good name and clearing 
the records. 

Case 9: Co-Worker ID theft 

The victim recently found out of the identity theft. In 1999, a co-worker stole her 
credit card. The victim went through all the necessary procedures with her credit 
card company to remove the charges including filing a police report. In January 
2002, the victim applied for a loan with a small finance company. The victim was 
told her social security number had already been used to apply for a loan with this 
company. The victim retrieved the application and found it was used back in 1999 
by the same woman who stole her credit card. The victim had never been contacted 
by this company. The company’s reply was that they denied the application. Unfor- 
tunately, in doing so, they did not indicate that it was denial due to fraud but due 
to not enough income. 

Victim did speak to the finance company about this and even spoke with the Vice 
President in South Carolina who was not helpful. Victim still has not received a 
copy of her credit report so she is not sure if the imposter has done any real damage 
or not. Victim is certain that she used her social security number and she is not 
sure how else she can file a report if the police are not helpful. 

Case 10: Extreme identity theft case 

Victim’s identity was stolen by a co-worker 10 years ago. She knows who the im- 
poster is and he has been questioned but released by police (refusal to take action 
due to “extenuating family circumstances”). In the meantime, the victim has been 
unable to stop the imposter from opening credit and checking accounts, fraudulently 
applying for welfare, etc. She has had to change her SSN, driver’s license number 
and name, essentially recreating herself in order to separate and protect her from 
the actions of the imposter. 

Case 11: Reoccurring identity theft 

My wife was a victim of identity theft in 1999. After many letters, a police report 
and an affidavit of forgery, we thought everything was settling. We were reassured 
that the loan and credit that was taken out in our name was removed from our re- 
ports and that our credit was restored. We asked several times for correspondence 
that this was taken care of but no one returned a letter. As time passed and we 
received no bills and we forgot about it. That is until we received an Equifax report 
on 6-2-02 showing that the fraud was still on the report. I tried to contact the office 
that I communicated with before but no one would return my call. 

The date reported was after we had notified Equifax of the dispute. Are they in 
violation of the (FCRA)? Please advise or direct. 

Case 12: Family ID theft 

Victim’s relative used victim’s identity to clear out victim’s bank accounts. This 
relative has victim’s SSN and stolen checks. Victim has filed a police report and is 
in contact with the managers at her bank. Law enforcement is not investing a great 
deal of time on case, usually claiming that this is a family dispute. 

Family identity theft is one of the most difficult crimes we work on, in part due 
to lack of police action and in part due to the emotional impact of this crime. How 
does one turn one’s own mother in to the police? Unfortunately, we receive about 
3-5 of these types of cases each week. 
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Case 13: Domestic abuse and harassment 

The victim was divorced in 1987. She now lives in Florida. The ex-husband is op- 
erating in San Diego. Due to the actions of her ex, the victim is having IRS and 
SSA problems and is dealing with 3 accounts opened in her name. Unfortunately 
ID theft is the perfect tool to harass another person and to perpetuate domestic 
abuse after a divorce or separation. 

Case 14: Stolen wallet 

I live in TX. On June 2, 2002 my wallet was stolen in New York City. On June 
6, 2002 a woman began using my identity from the wallet including drivers license, 
social security number from a medical insurance card, place of employment and sto- 
len cards to establish instant credit at 9 different stores in 3 different states. I have 
placed a fraud alert on my credit report with the three credit reporting agencies but 
there has already been theft totaling in excess of $16,000 dollars. I am now having 
difficulty getting anyone to follow through with a police report and also changing 
my drivers license number. Because the theft occurred out of my home state, I have 
to follow up on the phone and not getting much response or help. 

Case 15: Military spouse 

I have had the frustrating and humiliating experience of somebody taking my 
maiden name and social security number in order to open numerous fraudulent util- 
ity accounts leaving my credit reports a mess. I am also a military wife who is re- 
quired to show my social security number on my ID card, which is used for every- 
thing. 

Case 16: Enable credit granting behavior 

I was a victim of credit fraud/ID theft beginning in November of 2001, and con- 
tinuing until approximately April of 2002. All of the many fraudulent credit applica- 
tions using my name and identifying information were done in the Los Angeles 
area. Somehow, my personal identifying information (SSN, name, birth date, etc.) 
were obtained and used to apply for instant store credit at Radio Shack, Gateway 
Computers, and approximately a dozen other merchants. Additionally, my personal 
credit card was “taken over” by these criminals. By calling Visa and posing as me, 
they changed my billing address, and claimed that they had lost the credit card. 
They then received my new Visa card in the mail at the fraudulent address. They 
applied for many credit cards under my name and were even successful at getting 
a few, then charging the cards up to the maximum very quickly. 

Case 17: Mail theft by an acquaintance 

I just found out on June 14, 2002 that I am the victim of identity theft by my 
housekeeper/babysitter. Since she had access to my mail it was easy. She opened 
the first account in April 2001. She has charged over 10,000.00 that I am aware 
of and I have jewelry etc. missing from my home. 

This is so recent that I don’t even know what I’m up against yet — what I do know 
is that this has hurt my eleven year old daughter very badly. My daughter sang 
in the housekeeper’s wedding last May, I wonder now if the wedding was all 
charged to me! 

I would be happy to talk to anyone about this. I live in a small town of 12,000 
people right now I know 4 people personally that this has happened to including 
the president of one of the banks here in town. Something must be done!! She is 
having trouble getting creditors off her back. 

Case 18: Domestic abuse, insurance fraud 

My ex-husband and his employer used my Social Security number to file medical 
claims on my health insurance. My ex has not been covered on my insurance since 
1999, and I have changed employers and insurance carriers since that time. How- 
ever, claims for February 2002 through May 2002 have been filed on my current 
insurance. He has obtained the information without my knowledge. I found out 
about the claims after receiving Explanation of Benefit forms from my insurance 
provider. The claims have been denied, so the insurance provider states that they 
are doing their job. The insurer will not file a report with the police. 

Case 19: IRS complications 

Someone has stolen my social security number and from that caused me to have 
false credit bureau claims and a warning from the IRS that I had underreported 
my income. Creditors have harassed me and required me to go to extraordinary 



46 


lengths to prove that I could not have incurred the debt in question. The IRS has 
required extensive documentation as well. Right now the activity has settled down, 
but anytime the next shoe could fall. 

Even though there is a certain person I suspect of engaging in this identity theft, 
law enforcement authorities turn a deaf ear. I really don’t blame them; it’s not a 
high priority crime to them. To me, it is a major theft and close akin to rape. 

This whole situation has been aided by the use of computers and the overuse of 
the social security number. I understand that the original law establishing the 
issuance of social security numbers stated that that number should only be used for 
social security, but indeed that has not been the case. 

Case 20: Victim frustration — complex case 

I became a victim of identity theft in March 2001. I found out when the person 
who had my social security number tried to open a credit card with a bank that 
I already had a card with. The woman was not able to give my correct birthday. 
They contacted me but they gave me a hard time saying that it was my daughter. 
They suggested that I contact the credit agencies about a fraud alert. That is when 
I found out that the person had many credit cards and a cell phone and they even 
bought a computer from Dell. Since I found out early I was able to stop almost ev- 
erything before it was way out of hand. I filed a report with the Dallas police de- 
partment and talked to a detective on a regular basis; only to find out they would 
do nothing. They had the address to which the credit cards and computer were sent 
but they would not go there. They even had another address where the person used 
a credit card in my name to buy a pizza. It took many months to clear everything 
up and I still have the fraud alert on my report for seven years. This is a crime 
that is to easy for someone to do and they get away with it because our laws are 
too easy and the officers are not trained on this type of crime. I feel I am luckier 
then most because I found out early and was able to clear up the damage within 
a year. 

While you know my story, that only tells part of the picture. What I discovered 
disturbed me greatly: 

1. Fraud alerts only help a little. Most places do not even honor them. So I’m not 
sure they help very much. 

2. After I put the fraud alert on, they still opened a few more credit cards. All 
of the accounts they opened were done on the Internet. 

3. I found that the credit card companies did not care much, they just closed the 
accounts. But before they will close the accounts you have to prove to them it 
was not you who opened the account. 

4. They also made you wait on the phone a long time and you are transferred 
to many people before you found one that could help you. Most of the people 
I talked with acted like they were not educated enough on the subject. 

5. They treat you like it was your fault and most of them need more training on 
this issue. 

6. The police are no help at all. 

7. The credit agencies take forever to remove the fraud accounts from your file. 

8. The victim spends hundreds of hours writing letters and phone calls trying to 
remove the damage the thief caused while they are free to go to the next vic- 
tim. 

9. The Laws should help the victims, but you are alone when it comes to identify 
theft. 

Case 21: Child ID theft 

(Address, email and phone of victim will be provided to the members of the com- 
mittee upon request. Copy and paste with permission of victim) 

I am a mother of a thirteen-year-old son. I share joint legal custody with his fa- 
ther, who lives in a different county. Although my two boys primarily live with their 
father in ###, California, they visit frequently and spend all of their summers and 
vacations with my new husband and me. 

About two years ago, my mother and I were in the process of setting up college 
fund accounts for my two sons. We were informed by our investor that my oldest 
son’s social security number had several active accounts and recommended that we 
research this matter further before proceeding to open any financial accounts under 
his name and social security number. Unfortunately for my son, the thief is his own 
father. They both share the same base name and physical address. Therefore, the 
theft of my son’s social security number was an easy accomplishment by his father. 

In going through this case of Identity Theft, I have encountered various problems 
along the way. First being that the local law enforcement agency in the county in 
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which my son resides with his father, refused to take an identity theft report be- 
cause their county does not have a department that handles such matters. Because 
of this and the fact that my son is a minor, it took several months, almost the re- 
mainder of the year to obtain a copy of my sons credit report. The three credit re- 
porting agencies refused to issue any information because he was a minor. Instead 
of investigating the matter further, they sent a standard “refusal to issue informa- 
tion letter” based on the fact that he was under the age of 18 and that they do not 
issue reports for minors. Without this report, it has been nearly impossible to get 
any response from creditors as well as getting a credit issuer to take me seriously. 
The report was subsequently acquired, through diligence and perseverance. 

I have also attempted to write letters to each lender and attach a copy of his cred- 
it report as proof of an existing account, I have had to send follow up letter as well, 
and have yet to hear a reply as they are not required to respond or assist with 
fraudulent accounts. 

As a mother of a victim of Identity Theft, I would highly recommend that all state 
and local law enforcement agencies be required to generate a report on identity theft 
complaints in the jurisdiction where the victim lives and to provide a copy of the 
report to the victim, regardless of their subsequent decision on whether or not the 
agency will investigate the case. If by chance, there had already been laws in effect, 
it would clearly have been easier to obtain credit reports for a minor with parental 
documentation. It would also have directly influenced the ability to stop further 
debit from occurring. 

As you might imagine the recourse for this action can lead in several directions. 
Although I do not wish to amend this crime out of vengeance towards my son’s fa- 
ther. I am deeply worried that as my son approaches adulthood and tries to obtain 
college grants, scholarships, etcetera, he will be denied due to his already existing 
debt. To this day, his father has acquired over $250,000.00 in debt under our son’s 
social security number. I cannot begin to imagine the long-term affect that this 
amount of debt will have on my son’s future. 

Knowing my son as I do, it has been a difficult decision to keep this information 
from him. As he has already suffered emotionally from the divorce, I deeply fear 
that this will emotionally tear him apart and sever all bonds he has created with 
his father. I also fear that the impact of knowing that his father was the criminal 
will have a psychological scaring on him for the remainder of his life. 

Finally, in trying to rectify this matter with the social security administration, 
and in conjunction with my family law attorney, this entire matter must be handled 
with diligence and on an efficient manner. Because of the fact that I share joint cus- 
tody with my ex husband, I have an incredible fear, based on past actions, that if 
and when his father is confronted with the truth of his crimes, he will then take 
matters to extreme action and kidnap my son, making it impossible for me to have 
any further contact with him. This also presents the problem of obtaining a new 
social security number. Because our son is still a minor, the new number will have 
to be disclosed to his father for medical and scholastic purposes. An even greater 
fear is that his father will continue to abuse his son in this manner. Based on 
passed history of his fathers actions of first destroying his own credit, and now de- 
stroying his son’s credit, what will prevent him from committing the crime once 
again. Unfortunately, I do not see this cycle ending without laws to protect victims 
of fraud as well as minors. 

Part Three: Issues to be discussed 

It is clear that a list of commonalities can be derived from ITRC’s victim accounts 
set forth above. Categories where the SSN has been an instrument to create havoc 
include: 

• Use of the SSN for as a driver’s license number 

• ID theft of the Deceased 

• Child identity theft 

• Failure of governmental agencies to find alternate ways to protect identifying 
numbers used by the government: military ID number, Medicare/state health 
insurance number (could be done by random number matching to SSN in a 
closed, secure database) 

• Employer use of the SSN as an individual employee (private or governmental) 
ID number, including public display of the SSN, e.g., timecards, badges 

• The use of the SSN as an identifier by a business group, printed on a card car- 
ried by the person on a regular basis 

• Mail theft — where the SSN is printed (unnecessarily) on the document being 
mailed and is intercepted by another person 
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• Theft of SSN given in good faith to or displayed or sold by a business which 
required the information to complete a transaction or activity — e.g., to obtain 
health care benefits. 

• Collection of information not needed for the necessary task or program 

• Failure to protect collected information — e.g., disposed of inadequately 

• Database or information breach — failure to provide proper security 

• Database or information breach — due to the actions of an individual who had 
access to the information that never should have been collected in the first place 

• Domestic abuse, harassment of an ex — due to extensive use of the SSN as an 
identifier 

• Restrictions on sale of SSN and credit info to third parties by governmental 
agencies or private entities 

• Unrestricted ability to print SSN of individuals on web sites, e.g. Ancestry.com 

• Failure to truncate parts of SSN on documents available to the public — elec- 
tronic court records, birth and death certificates, etc., unless the requesting 
party has a legitimate reason for such information 

Part Four: Recommendations for Laws 

ITRC likes to use a Finding/Recommendation format to advise on new legislation. 
In this testimony, ITRC will limit its findings with the belief that this esteemed 
committee has studied this subject at length and does not need substantial back- 
ground information. 

This list is a preliminary discussion and ITRC’s directors would be honored to 
continue to work with the committee as they explore this topic and prepare legisla- 
tion that will protect all of us from SSN abuse. 

1. Use of the SSN as the driver’s license number 

Finding: At this time, individuals have a choice in those remaining states that 
continue to use the SSN as the driver’s license number. This practice means that 
each check written includes one’s SSN and that individuals with social security 
numbers on their license suffer greater loss due to lost/stolen wallets. 

Recommendation: Due to lack of consumer education, ITRC believes that states 
MUST be required to adopt a random number system and replace the SSN on all 
drivers’ licenses within 1 year of the passage of this legislation. 

2. Identity theft and the Deceased 

Finding: Despite a person’s death, a SSN continues to be active and may be used 
for the extension of credit. The Master Death Registry controlled by the SSA does 
not include the names of all deceased. Information is added to this list in a variety 
of methods, some of which are only consumer generated. Too many stories have 
been printed and too many cases have occurred where a deceased individual’s SSN 
has been used to get credit. 

Example: Florida Department of Law Enforcement agents arrested William Troy 
Herman and Ronnie J. Skipper for fraud. Agents say the duo used the personal in- 
formation of seven deceased individuals to obtain credit cards in the victims’ names. 

This causes problems for the estate and additional stress on the bereaved. The 
letters we receive from them are painful and their distress is evident. 

Recommendation: ITRC’s executive directors are currently working with Sen- 
ator Corzine and U.S. House Representative Gutierrez on legislation to correct this 
issue. It would make sure that all deaths are recorded on the death register, for- 
warded to the repositories that will then mark all of those SSNs as “Deceased, do 
not issue credit.” This list must be designated as not to be sold, distributed or used 
for any purpose other than the one itemized above. 

3. Identity Theft of Children 

Finding: There are several types of child identity theft scenarios that ITRC typi- 
cally sees: 

• It’s a split family. One of the parents finds out that the other parent (or the 
“friend” of the parent) has begun to use the child’s identity to gain credit or a 
driver’s license. This is usually because they have already ruined their own 
credit or driving record. They plan on “fixing” everything before that child 
reaches 18. They even swear they were planning on paying all the bills accrued 
under the child’s SSN. The reality is that they eventually will ruin the child’s 
credit just as they ruined their own. 

• Upon reaching 16, the child applies for a driver’s license. They are denied be- 
cause someone already has a driver’s license using that SSN. 
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• Upon reaching 17 and applying for a college loan, the teen finds out he or she 
cannot qualify due to a poor credit rating. This has sometimes resulted in a one- 
year delay in starting college. 

• Upon reaching 18, the now adult child is denied credit, unable to gain employ- 
ment or rent an apartment due to a poor credit rating. They find out that some- 
one has used their info for the past 10 years and they are $15,000 in debt. Be- 
fore their true adult life has begun, it is tainted and may take years to clear 
up. 

• Now an adult and in the workplace, the victim finds it difficult but not impos- 
sible to get credit. Perhaps they think it is because of their youth and that the 
first card they did get they mishandled and perhaps had to pay off over time. 
They have never checked their credit reports until one day a collection notice 
reaches them — perhaps at the age of 25 or even 30. Once checking their credit 
reports, they find out that for the last 15 years someone else has been opening 
up accounts in their name. 

Their imposters often are family members, parents or guardians, or may be illegal 
aliens who purchased the information from traffickers who purposely sell informa- 
tion that belongs to children due to the lengthy time prior to crime discovery. 

Recommendation: Elderly and children are deserving of additional protection 
under the law. No one disagrees with that. We must assume the role of caregivers 
and make sure that those individuals are not abused — physically or financially. 
ITRC’s recommendation is that the SSA creates a list using birth records of all SSN 
and birthdates. This list would be given to the repositories that may not sell, dis- 
tribute or use it for other than the intended purpose. Should a credit application 
be submitted with the SSN of an individual (child) on the list, then that application 
must be further investigated and such investigation well documented. When a child 
reaches the age of majority, their information would be deleted from the list. ITRC 
would also like to see any person who commits child identity theft receive an en- 
hanced penalty for this crime. 

4. The need to find alternate ways to protect identifying numbers used by 
the government: military ID number, Medicare/MediCal number, etc. 

Finding: On July 6, 2003, Parade Magazine’s (in the Sunday paper) centerpiece 
discussed identity theft. More than 70% of the emails ITRC received were from peo- 
ple either concerned about lost and stolen wallet issues or from people who are 
angry at either governmental agencies (SSA, military) or health providers that place 
the SSN on a card they must carry on a daily basis. Those many concerns must 
not go unheard. 

Lost and stolen wallets are a prime way for thieves to gather information. Unfor- 
tunately, the federal government as well as state governments (and health pro- 
viders) also use SSN as employee or member numbers: military, elders and Medi- 
care, etc. These numbers are seen by dozens of people through the course of daily 
activities. Colleges and universities must also be included in this list since NY is 
the only state that prohibits the use of the SSN as the student identifier and almost 
all college students we have spoken with have told us that it is being used as their 
student ID number — often written down on rosters, papers passed around class- 
rooms, posted on bulletin boards, placed on college transcripts, etc. 

Recommendation: If the SSN must be in the database, then we must find a way 
to assign a random number that will be on the card that is carried and put on the 
multiple forms that are filled out by the individual. Right now, college students, sen- 
iors and military are our most vulnerable population groups due to the fact that 
their SSN is so widely known and used. That number can be linked in a database 
if necessary, at a high level of security. If the federal government expects the busi- 
ness community to change systems, it must lead by example. 

5. Overuse of the SSN 

Findings: The following categories demonstrate the problem of the over- 
use of the SSN. 

• Employer use of SSN as individual employee (private or governmental) ID num- 
ber, including public display of such, e.g., timecards, timesheets, cash register 
use number, badges, etc. 

• The use of the SSN as an identifier by a business group, printed on a card car- 
ried by the person on a regular basis. 

• Mail theft — where the SSN is printed unnecessarily on the document being 
mailed and is intercepted by another person. 

• Theft of SSN given in good faith to a business who required the information 
to complete a transaction or activity — e.g., get health care benefits. 



50 


• Domestic abuse, harassment of an ex — due to extensive use of the SSN as an 
identifier. Most of us know the SSN of our spouses, ex-lovers, etc. This crime 
is a perfect tool to harm another. 

Recommendations: Private entities may not use the SSN other than for tax pur- 
poses or other purposes so designated by either state or federal governmental agen- 
cies. They may not publicly display, use, sell or share the information. Language 
for a bill may be found in California’s SSN Confidentiality bills, many written by 
CA Senator Debra Bowen. 

6. SSN Protection 

Findings: It is critical that any entity, whether private or governmental, safe- 
guard identifying information properly. The following categories are just some of the 
areas that must be included in any legislation considered. 

• Need to render all sensitive information unreadable prior to disposal, electronic 
or in paper format 

• Restrict collection of information not needed for the necessary task or program 

• Need to require adequate database and paper information storage 

• Need to require notification of any database or information breach 

Recommendations: It is critical that minimum standards be set for acquiring, 
access, disposal, storage and breach of information fields that include the SSN as 
well as other sensitive information. This includes what information may be re- 
quested by a company and when. For example, no one is hired on the basis of a 
job application. That is a screening device and hundreds may be collected for a sin- 
gle job. Yet each one asks for your SSN. Why? All they need to do at that stage 
is ask if you have a SSN and would be willing to provide it upon request. That infor- 
mation can be exchanged when an employer is narrowed the field and is serious 
about a new hire. This protects consumers from overextension and viewing of the 
SSN (think of the many applications a job seeker fills out) and limits the company’s 
liability in terms of acquiring and storage of sensitive information. Language for 
some of these bills can be found in some new California laws as well as in some 
of the bills now under consideration at the federal level. 

7. Restrictions on sale of SSN and credit info 

Finding: The less people with access to SSNs, the less opportunity there is for 
leakage to identity thieves. 

Recommendation: Federal restrictions on the sale, exchange or transfer of SSN 
and credit info to third parties by governmental agencies or private entities. 

8. Restriction on public posting of SSN 

Finding: This problem falls into two categories: websites and public records. Both 
allow unlimited viewing by both criminals and people with legitimate purposes. 

Recommendations: 

• Federal restrictions regarding the publication of SSNs of individuals, alive or 
dead, on web sites, e.g., Ancestry.com. 

• Federal requirements to truncate parts of SSN and other sensitive information 
(to be decided by committee) on documents available to the public, e.g., elec- 
tronic court records, birth and death certificates, etc., unless the requesting 
party has a legitimate reason for such information. 

IN CONCLUSION: 

The crime of identity theft, like any other thing in our society grows, evolves and 
constantly changes along with the changes in our society. In 1970, the writers of 
the FCRA could not have predicted the credit trends and practices of the year 2003. 
They created the FCRA when all business was conducted in person, in communities 
where people were known and applications could be verified. 

When FDR expanded the use of the SSN as an identifier, he could not have antici- 
pated the Pandora’s box that he would open. It was impossible to predict the impact 
of the information age and how computer technology would allow a crime like iden- 
tity theft to flourish. 

In 2000, the FTC held a hearing on ID theft in which ITRC participated. The FTC 
has continued to monitor this crime through its databases and through victim pan- 
els. The information has not changed, nor have the laws. In fact, members of ITRC’s 
staff has attended hearings and provided information for years now to federal legis- 
lators and governmental agencies about changes that need to be made, but few if 
any bills have been passed. The most recent was passed because of its link to Home- 
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land Security. It imposes higher penalties for all those criminals who are not caught 
in the first place. 

Now it has come down to the final question. Can you meet the challenge to create 
and pass the much-needed bills in a timely manner, prior to the end of this year? 
If you cannot, then all this action and activity is nothing more than talk. If you are 
serious about identity theft and feel you can address it sufficiently on a national 
basis, this is your opportunity to prove it. But keep in mind — we (consumer, victims, 
advocates and the business community who care about combating this crime) have 
high standards for the laws that you pass. We will not accept weak laws that either 
do little to help the situation or weaken existing laws that have a proven track his- 
tory. State legislators will take action where the Federal government fails to. 

ITRC’s sole purpose is to combat this crime and to help victims. Its fear is that 
the public will be promised strong laws that allow for expansion and redirection as 
this crime evolves, but such laws will never materialize. 

ITRC believes it is the time for some action. We need the subjects covered by this 
testimony to be addressed and signed into law. The greatest leaders throughout his- 
tory have led by example. They never asked of others what they were not willing 
to do themselves. The federal government must also change their practices by pro- 
tecting SSNs for military personnel, our seniors and governmental employees. Oth- 
erwise, they do not have the right to ask the business community to comply. This 
administration and this Congress must take the lead and set the standard for the 
rest of the country. It is up to you to show us that this crime is being taken seri- 
ously by one and all. 

Thank you for your time and consideration. 


Chairman SHAW. Mr. Hoofnagle. 

STATEMENT OF CHRIS JAY HOOFNAGLE, DEPUTY COUNSEL, 
ELECTRONIC PRIVACY INFORMATION CENTER 

Mr. HOOFNAGLE. Thank you, Chairman Shaw, and Members of 
the Subcommittee. My name is Chris Hoofnagle, and I am Deputy 
Counsel with the Electronic Privacy Information Center. We appre- 
ciate the opportunity to testify on this very important matter 
today. In our written testimony, we detailed the development of the 
SSN and historical attempts to regulate the identifier. As you are 
well aware, today the SSN plays an unparalleled role in the identi- 
fication, authentication and tracking of Americans, but I would like 
to focus my comments today on several recent developments — de- 
velopments that include large-scale theft of identity cases, the con- 
tinued use of a SSN by private sector actors, including colleges and 
universities and the role of States in passing Social Security legis- 
lation. I believe these developments continue to institute more evi- 
dence that a national framework for privacy protection for the SSN 
is necessary. Accordingly, I am here to make only one recommenda- 
tion today, and that is to ask the Committee to reintroduce H.R. 
2036 from the 107th Congress. That is an excellent measure. Many 
of its provisions will allow us to put the SSN genie back into the 
bottle. Often in the privacy debate, people say it is too late, that 
your privacy is already gone, but as we have seen with tele- 
marketing, it is possible to assign rights and responsibilities and 
personal data and help put our private information back into the 
bottle and safeguard individual rights. 

Again, I think there are three recent trends that are worth high- 
lighting. The first, of course, is that the SSN continues to be the 
key to identity theft, as Mr. Wern testified. In our written testi- 
mony, we identify several cases where identity thieves or computer 
crackers have targeted databases that contain the SSN. In a New 
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York case SSNs were stolen from a State insurance fund, a college 
and several private businesses. Another involved a computer help 
desk employee who using access codes for Ford Motor Credit was 
able to obtain tens of thousands of credit card reports with SSNs 
from Experian. Yet another involved employees who took advan- 
tage of a patient identification system that used the SSN to commit 
identity theft. Researchers at Michigan State University recently 
studied over 1,000 identity theft cases and found that victims in 50 
percent of the cases specifically reported that the theft was com- 
mitted by an employee of the company that maintained their per- 
sonal information. There is very little an individual can do about 
these identity theft cases that are insider jobs or cases where per- 
sonal information is stolen from a database, and this is one of the 
reasons why we think we need to get the SSN out of circulation, 
to stop reliance on the identifier, because in most cases, you can’t 
prevent its theft. 

Another trend illustrated in our written testimony is that many 
public and private sector entities continue to use the SSN for iden- 
tification. As we have testified before, in most cases, it is wholly 
unnecessary for a business to collect your SSN. The Blue Cross/ 
Blue Shield insurance cards that Representative Cardin and Mr. 
Wern held up contain their SSN, and there is absolutely no reason 
for them to do that. They could assign a random identifier, and the 
only case where they actually need to collect the SSN is when your 
health costs actually have a tax consequence. Nevertheless, recent 
news reports indicate that major companies, including Blockbuster 
Video, Sam’s Club, and Costco continue to demand a SSN for mem- 
bership. A related problem is that many colleges and universities 
in the country continue to use a SSN as the primary student iden- 
tifier. In a recent study done by the American Association of Colle- 
giate Registrars of 1,300 institutions, half of those polled claim that 
they still use a SSN as a primary identifier. It is actually on the 
card, the student identity card, or in the record database. 

These trends involving use and misuse of the SSN and identity 
theft have actuated State leaders to create new protections for per- 
sonal information. In the college and university context, about six 
States have passed laws saying that schools can’t use the SSN as 
the identifier. In Florida, there was a special grand jury report that 
recommended that SSNs be scrubbed from public records and from 
private institutions. They noted specifically that one of the major 
problems about the SSN was that local governments were asking 
for it, and then the local government would place it in the public 
record. In California, Senate bill S. 1386 went into effect just a cou- 
ple weeks ago, and that legislation requires people who maintain 
databases that have SSNs in it, to give notice to individuals if their 
SSN is stolen out of the database. So, assigning a responsibility to 
people who actually collect the SSN or maintain it can often create 
new protections. I see that my red light is on, so let me just come 
to our recommendation, and that is that we do hope that Chairman 
and other Members will reintroduce H.R. 2036, and we have ideas 
for substantive improvements to it that we are happy to share with 
you, many of which are included in our written testimony. Thank 
you for the opportunity to testify today. 

[The prepared statement of Mr. Hoofnagle follows:] 
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Statement of Chris Jay Hoofnagle, Deputy Counsel, Electronic Privacy 
Information Center 

Chairman Shaw, Ranking Member Matsui, and Members of the Subcommittee, 
thank you for extending the opportunity to testify on use and misuse of Social Secu- 
rity Numbers. 

My name is Chris Hoofnagle and I am deputy counsel with the Electronic Privacy 
Information Center (EPIC), a not-for-profit research organization based in Wash- 
ington, D.C. Founded in 1994, EPIC has participated in cases involving the privacy 
of the Social Security Number (SSN) before federal courts and, most recently, before 
the Supreme Court of New Hampshire. 1 EPIC has also taken a leading role in cam- 
paigns against the use of globally unique identifiers (GUIDs) involving the Intel 
Processor Serial Number and the Microsoft Corporation’s Passport identification and 
authentication system. EPIC maintains an archive of information about the SSN on- 
line at http://www.epic.org/privacy/ssn/. 

I appreciate the opportunity to testify today. In the testimony below, we will first 
review historical and recent attempts to regulate the use of the SSN. This section 
demonstrates that there is ample legislative and judicial support for limitations on 
the collection and use of the SSN. 

The second section describes trends involving the SSN. These include: 

• A statistical rise in identity theft complaints to federal authorities. 

• The occurrence of several large-scale identity theft cases, many of which in- 
volved “insiders” or other trusted persons who had access to SSNs. 

• Colleges, universities, and other schools continue to identify students by the 
SSN. 

• Health providers and insurance companies continue to identify individuals by 
the SSN. 

• Companies continue to condition access to products and services on disclosure 
of the SSN. 

• Litigation has provided more privacy for SSNs in some cases. 

• Privacy advocates and other activists have posted public officials’ SSNs to pro- 
test government activity. 

• A number of states are innovating solutions to the SSN problem. 

Finally, in the last section we recommend that the Committee revisit 107 H.R. 
2036, The Social Security Number Privacy and Identity Theft Protection Act of 
2001. That bill, which enjoyed wide bipartisan support in the last Congress, should 
be reintroduced and passed by this Congress. Alternatively, we recommend that the 
Committee consider 108 H.R. 1931, the Personal Information Privacy Act of 2003. 
That bill would establish important protections for the SSN, including moving the 
SSN “below the line” on the credit report. 

I. Historical Regulation of the Collection and Use of the SSN 

The Social Security Number (SSN) was created in 1936 as a nine-digit account 
number assigned by the Secretary of Health and Human Services for the purpose 
of administering the Social Security laws. SSNs were first intended for use exclu- 
sively by the federal government as a means of tracking earnings to determine the 
amount of Social Security taxes to credit to each worker’s account. Over time, how- 
ever, SSNs were permitted to be used for purposes unrelated to the administration 
of the Social Security system. For example, in 1961 Congress authorized the Inter- 
nal Revenue Service to use SSNs as taxpayer identification numbers. 

A major government report on privacy in 1973 outlined many of the risks with 
the use and misuse of the Social Security Number. Although the term “identify 
theft” was not yet in use, Records Computers and the Rights of Citizens described 
the risks of a “Standard Universal Identifier,” how the number was promoting 
invasive profiling, and that many of the uses were clearly inconsistent with the 
original purpose of the 1936 Act. The report recommended several limitations on the 
use of the SSN and specifically said that legislation should be adopted “prohibiting 


1 Estate of Helen Remsburg v. Docusearch, Inc., et al, C-00— 211— B (N.H. 2002). In Remsburg, 
the “Amy Boyer” case, Liam Yotiens was able to locate and eventually murder Amy Boyer 
through hiring private investigators who tracked her by her date of birth, Social Security Num- 
ber, and by pretexting. EPIC maintains information about the Amy Boyer case online at 
http://www.epic.org/privacy/boyer/. 



54 


use of an SSN, or any number represented as an SSN for promotional or commercial 
purposes.” 2 

In response to growing risks over the accumulation of massive amounts of per- 
sonal information and the recommendations contained in the 1973 report, Congress 
passed the Privacy Act of 1974. 3 Among other things, this Act makes it unlawful 
for a governmental agency to deny a right, benefit, or privilege merely because the 
individual refuses to disclose his SSN. This is a critical principle to keep in mind 
today because consumers in the commercial sphere often face the choice of giving 
up their privacy, their SSN, to obtain a service or product. The drafters of the 1974 
law tried to prevent citizens from facing such unfair choices, particularly in the con- 
text of government services. But there is no reason that this principle could not 
apply equally to the private sector, and that was clearly the intent of the authors 
of the 1973 report. 

Section 7 of the Privacy Act further provides that any agency requesting an indi- 
vidual to disclose his SSN must “inform that individual whether that disclosure is 
mandatory or voluntary, by what statutory authority such number is solicited, and 
what uses will be made of it.” At the time of its enactment, Congress recognized 
the dangers of widespread use of SSNs as universal identifiers. In its report sup- 
porting the adoption of this provision, the Senate Committee stated that the wide- 
spread use of SSNs as universal identifiers in the public and private sectors is “one 
of the most serious manifestations of privacy concerns in the Nation.” Short of pro- 
hibiting the use of the SSN outright, the provision in the Privacy Act attempts to 
limit the use of the number to only those purposes where there is clear legal author- 
ity to collect the SSN. It was hoped that citizens, fully informed where the disclo- 
sure was not required by law and facing no loss of opportunity in failing to provide 
the SSN, would be unlikely to provide an SSN and institutions would not pursue 
the SSN as a form of identification. 

It is certainly true that the use of the SSN has expanded significantly since the 
provision was adopted in 1974. This is particularly clear in the financial services 
sector. In an effort to learn and share financial information about Americans, com- 
panies trading in financial information are the largest private-sector users of SSNs, 
and it is these companies that are among the strongest opponents of SSN restric- 
tions. 

Outside the financial services sector, many companies require the SSN instead of 
assigning an alternative identifier. These requirements appear in a myriad of com- 
mercial interchanges, many of which absolutely do not require the SSN. For in- 
stance, Golden Tee, a popular golf video game, requires players to enter their SSN 
in order to engage in “tournament play.” 4 The company could assign its own identi- 
fier for players, but instead relies upon the SSN, which puts players at risk by re- 
quiring them to further circulate personal information. 

It is critical to understand that the legal protection to limit the collection and use 
of the SSN is still present in the Privacy Act and can be found also in recent court 
decisions that recognize that there is a constitutional basis to limit the collection 
and use of the SSN. When a Federal Appeals court was asked to consider whether 
the state of Virginia could compel a voter to disclose an SSN that would subse- 
quently be published in the public voting rolls, the Court noted the growing concern 
about the use and misuse of the SSN, particularly with regard to financial services. 5 
The Fourth Circuit said: 

Since the passage of the Privacy Act, an individual’s concern over his 
SSN’s confidentiality and misuse has become significantly more compelling. 

For example, armed with one’s SSN, an unscrupulous individual could ob- 
tain a person’s welfare benefits or Social Security benefits, order new 
checks at a new address on that person’s checking account, obtain credit 
cards, or even obtain the person’s paycheck. . . . Succinctly stated, the harm 
that can be inflicted from the disclosure of a SSN to an unscrupulous indi- 
vidual is alarming and potentially financially ruinous. 6 

The Court said that: 

The statutes at issue compel a would-be voter in Virginia to consent to 
the possibility of a profound invasion of privacy when exercising the funda- 


2 Department of Health, Education, and Welfare, Records, Computers, and the Rights of Citi- 
zens 108—35 (MIT 1973) (Social Security Number as a Standard Universal Identifier and Rec- 
ommendations Regarding Use of Social Security Number). 

3 5 U.S.C. §552a. 

4 Official ITS Rules, at http://www.itsgames.com/ITS/its rules.htm. 

5 Greidinger v. Davis, 988 F.2d 1344 (4th Cir. 1993). 

6 Id. 
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mental right to vote. As illustrated by the examples of the potential harm 
that the dissemination of an individual’s SSN can inflict, Greidinger’s deci- 
sion not to provide his SSN is eminently reasonable. In other words, 
Greidinger’s fundamental right to vote is substantially burdened to the ex- 
tent the statutes at issue permit the public disclosure of his SSN. 7 

The Court concluded that to the extent the Virginia voting laws, “permit the pub- 
lic disclosure of Greidinger’s SSN as a condition of his right to vote, it creates an 
intolerable burden on that right as protected by the First and Fourteenth Amend- 
ments.” 8 

In a second case, testing whether a state could be required to disclose the SSNs 
of state employees under a state open record law where there was a strong pre- 
sumption in favor of disclosure, the Ohio Supreme Court held that there were pri- 
vacy limitations in the federal Constitution that weighed against disclosure of the 
SSN. 9 The court concluded that: 

We find today that the high potential for fraud and victimization caused by the 
unchecked release of city employee SSNs outweighs the minimal information about 
governmental processes gained through the release of the SSNs. Our holding is not 
intended to interfere with meritorious investigations conducted by the press, but in- 
stead is intended to preserve one of the fundamental principles of American con- 
stitutional law — ours is a government of limited power. We conclude that the United 
States Constitution forbids disclosure under the circumstances of this case. There- 
fore, reconciling federal constitutional law with Ohio’s Public Records Act, we con- 
clude that [the provision] does not mandate that the city of Akron discloses the 
SSNs of all of its employees upon demand. 10 

In an important recent case from the U.S. Court of Appeals for the D.C. Circuit, 
a Court upheld the Federal Trade Commission’s determination that SSNs are non- 
public personal information under the Gramm-Leach-Bliley Act. 11 The Court re- 
jected First and Fifth Amendment challenges to regulations that restricted the use 
of the SSN without giving the individual notice and opportunity to opt-out. Addi- 
tionally, the Court upheld regulations that prohibited the reuse of SSNs that are 
furnished to credit reporting agencies. 12 

While it is true that many companies and government agencies today use the So- 
cial Security Number indiscriminately as a form of identification and authentica- 
tion, it is also clear from the 1936 Act, the 1974 Privacy Act, and these three 
cases — GreicLinger v. Davis, Beacon Journal v. City of Akron, and Trans Union v. 
FTC — that there is plenty of legislative and judicial support for limitations on the 
collection and use of the SSN. The question is therefore squarely presented whether 
the Congress will at this point in time follow in this tradition, respond to growing 
public concern, and establish the safeguards that are necessary to ensure that the 
problems associated with the use of the SSN do not increase. 

II. Recent SSN Trends 

Just in the last eighteen months, there have been a number of important SSN 
developments. These developments, which range from large-scale incidents of iden- 
tity theft to continued reliance on the SSN in the private sector, underscore the con- 
tinued need for a national framework of protections for the SSN. 

Identity Theft Complaints Increase 

The FTC reported on January 22, 2003 a large increase in the number of fraud 
complaints and a doubling of the dollar loss attributable to fraudulent activities di- 
rected at US Consumers. 13 The agency noted that the number of fraud complaints 
rose from 220,000 in 2001 to 380,000 in 2002 and the loss to consumers grew from 
$160 million in 2001 to $343 million in 2002. The report revealed that identity theft 
topped the list, accounting for 43% of the complaints lodged in the Consumer Sen- 
tinel database. 


UdL. 

s Id. 

9 Beacon Journal v. City of Akron, 70 Ohio St. 3d 605 (Ohio 1994). 

10 Id. 

11 Trans Union L.L.C. v. Fed. Trade Comm’n, No. 01—5202, 295 F.3d 42 (D.C. Cir. 2002), at 
http://pacer.cadc.uscourts.gov/commonyopinions/200207/01-5202a.txt. 

12 Id. In another recent case, the D.C. Circuit rejected a First Amendment challenge to the 
use of credit reports for marketing purposes. Trans Union v. FTC, 245 F.3d 809 (D.C. Cir. 2001), 
cert, denied, 536 U.S. 915 (2002). 

13 Fraud Charges Jump in 2002 on Consumer Complaints, ID Thefts, Electronic Commerce & 
Law Report, Vol 8(4), Jan. 29, 2003, 88. 
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The SSN Continues to be the Key to Identity Theft 

On January 10, 2002, a special Florida grand jury commissioned to investigate 
identity theft recommended stronger legal protections for personal data, including 
SSNs, held by business and State agencies. 14 It called for laws that would prohibit 
the credit industry from selling personal data without consumer consent, and would 
stop State agencies from disseminating personal information under the open records 
law without individual consent, court order, or the articulation of a compelling need. 
The panel charged 33 individuals with criminal use of personal identifying informa- 
tion, fraud, grand theft, and money laundering. The grand jury estimated that the 
current $2.5 billion nationwide cost of identity theft is expected to grow to $8 billion 
by 2005. It cited health clubs and video rental stores requiring SSNs on applications 
and local governments asking for SSNs on routine transactions. 

In August 2002, New York Attorney General Eliot Spitzer reported that law en- 
forcement authorities had broken “a massive identity theft ring.” 16 The information 
involved included SSNs, credit card numbers, and bank account information stolen 
from the NY State Insurance Fund, Social Security Administration, Empire State 
College, WNYC radio, Hollywood video, WorldCom Wireless, and American Express. 
The indictment alleges that this personal information was stolen between 1998 and 
2002, and used to purchase computer equipment, cell phones, and other merchan- 
dise. 

In November 2002, it was discovered that a former computer help desk employee 
had obtained 30,000 credit reports directly from a credit reporting agency. The 
former employee sold the reports to others for between $30-60 each. 113 The informa- 
tion was used for credit fraud. 

In December 2002, personal health care information, including SSNs, of more 
than 500,000 military personnel, retirees and family members in 16 Midwestern and 
western States were stolen from a military contractor. Also stolen were some active- 
duty service members’ claims processing information, which include their names, 
SSN, and list of medical procedures and diagnosis codes for medical care already 
performed. 17 TriWest stated that it attempted to notify beneficiaries by sending 
them letters and by posting notices on its web site. The database was not encrypted 
and TriWest relied on the SSN as an identifier. 

In February 2003, two former employees of health facilities and six others were 
charged with stealing patient SSNs that were used to open fraudulent credit card 
and phone accounts. 18 The suspects stole $78,000 in goods and services. One of the 
facilities involved has now implemented a new patient information system that 
doesn’t label patients by the SSN. 

Because of these and other developments, the Wall Street Journal, in its 2003 “to 
not do list,” advised individuals not to give out their SSN: “Don’t give out your So- 
cial Security number unless you have to: With identity theft a growing problem, you 
should be extremely cautious about giving out that information. Many organizations 
ask for it, from volunteer groups to retail stores to Web sites, but not all of them 
require you to provide it.” 19 

But as the cases listed above illustrate, many identity theft cases are “insider 
jobs,” committed by employees who obtain access and misuse individuals’ personal 
information stored in their employers’ databanks. Researchers at Michigan State 
University recently studied over 1000 identity theft cases and found that victims in 
50% of the cases specifically reported that the theft was committed by an employee 
of a company compiling personal information on individuals. 20 There is very little 
that an individual can do to prevent insider jobs, or cases where the SSN is stolen 
from a database. 


14 Identity Theft in Florida , Sixteenth Statewide Grand Jury Report, SC 01-1095, Supreme 

Court of Florida, Jan. 10, 2002, at http://www.idtheftcenter.org/attach/FL idtheft gj.pdf;see 

also Florida ID Theft Panel Backs More Safeguards for Government and Corporate Data , Privacy 
Times, Vol 22(3), Jan. 30, 2002, 3-4. 

15 New York Authorities Say They’ve Cracked ‘ Massive ’ Identity Theft Ring, Four Indicted, 
Electronic Commerce & Law Report, Vol 7(31), Aug. 7, 2002, p. 794. 

16 Huge ID-theft ring broken; 30,000 consumers at risk, Seattle Times, Nov. 26, 2002. 

11 Patient Data, 500,000 SSNs Stolen From DOD System, Privacy Times, Vol 23(1), Jan. 2, 
2003, 2. 

18 Margaret Zack, Eight charged with stealing patient IDs for credit cards, Star Tribune, Feb. 
21, 2003, p. IB. 

19 A To-Don’t List For the New Year, Hot to Fix Your Life in 2003, Wall Street Journal, Dec. 
31, 2002. 

20 Study forthcoming; results provided in email from Judith M. Collins, Ph.D., Associate Pro- 
fessor, Leadership and Management Program in Security School of Criminal Justice, Michigan 
State University to EPIC (Apr. 22, 2003, 18:13:35 EST) (on file with EPIC). 
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The SSN is Still Being Used as a Student Identifier 

Although privacy protections are important to students, student development, and 
to principles of academic freedom, schools have not always been sensitive to student 
informational privacy issues. A handful of states, including Arizona, 21 New York, 22 
Rhode Island, 23 and Wisconsin 24 have enacted laws to regulate college and univer- 
sity use of the SSN. Nevertheless, in a survey of 1,300 institutions polled by the 
American Association of Collegiate Registrars and Admissions Offers, half reported 
that they use the SSN as the primary student identifier. 25 

In August 2002, it was revealed that a Princeton admissions officer used the SSNs 
of applicants to his school to view the Yale University’s web site for admissions. The 
unauthorized entry allowed Princeton to learn whether Yale had accepted students 
who had applied to both schools. Cracking the system was easy: Anyone who knew 
an applicant’s birth date and SSN could log on. 26 

In March 2003, federal prosecutors charged a University of Texas student with 
breaking into a school database and stealing more than 55,000 student, faculty, and 
staff names and SSNs. The student was charged with violating the Computer Fraud 
and Abuse Act of 1986 and the Identity Theft and Assumption Deterrence Act of 
1998. This occurrence led to a new Texas law protecting against identity theft. 27 

Also in March 2003, it was reported that the California State University’s $662 
million computer system contains a security flaw that gives users access to student 
and employee SSNs and other confidential data. The problem was known for years, 
and university officials had told state auditors they were not going to fix the vulner- 
ability, citing cost and time concerns. 28 

In May 2003, a 17-year-old student of a Chino, CA high school allegedly cracked 
the school’s computer system, changing his and a classmate’s grades and also tap- 
ping into confidential student information, including the SSN. 29 Apparently, 1,744 
students had their SSNs in the database. 

For model approaches to the transition to an alternative student identifier, I 
would look to the leadership of Virginia Rezmierski, Professor at the Gerald R. F ord 
School of Public Policy at the University of Michigan. 30 Additionally, officials at the 
University of Illinois have established a procedure to reduce reliance on the SSN. 31 
The University of Pennsylvania is addressing the issue as well. That institution ap- 
pointed Lauren Steinfeld, a former privacy expert at the Office of Management and 
Budget, to address SSN issues. 

The SSN Has Become a Default Health Identifier 

Many medical providers are using the SSN as a patient identifier. As David Miller 
noted in testimony before the National Committee on Vital Health Statistics: 

“It should be noted that the 1993 WEDI [Workgroup for Electronic Data Inter- 
change] Report, Appendix 4, Unique Identifiers for the Health Care Industry, Ad- 
dendum 4 indicated 71% of the payers responding to the survey based the individual 
identifier on the Member’s Social Security Number. However 89% requested the in- 
sured’s Social Security Number for application of insurance. Clearly the Social Secu- 
rity Number is the current de facto identifier. . . ,” 32 

But individuals and companies are resisting such use of the SSN. Acting on em- 
ployees’ suggestions, I.B.M. has requested that health companies stop using the 


21 Ariz. Rev. Stat. § 15-1823. 

22 N.Y. Educ. Code §52-b. 

23 §42-72.5-2(6); § 16-38-5.1. 

24 Wise. Stat. Ann. § 118.169. 

25 Kristen Gerencher, Social Security numbers up for grabs. Companies, government lax in pre- 
venting identity theft, CBS MarketWatch, May 7, 2002, at http://cbs.marketwatch.com/news/ 
story. asp?guid=%7B9A569387%2DE7FD%2D44AB%2D8F5F%2D112D25915DA5% 
7D&siteid=mktw 

26 John Schwartz, Privacy vs. Security on Campus, The New York Times, Aug. 4, 2002, p. 3. 

27 Univ. of Texas SSN, Privacy Times," Vol 23(6), Mar. 17, 2003, 11. 

28 Terri Hardy, CSU computer flaw allows access to confidential data, The San Diego Union 
Tribune, Mar. 22, 2003, p. A-13. 

29 Kristina Sauerweine, Youth Hacked Into Database, Los Angeles Times, May 21, 2003, p. 5. 

30 See also Privacy and the Handling of Student Information in the Electronic Networked Envi- 
ronments of Colleges and Universities, EDUCAUSE White Paper, Apr. 1997, at http:// 
www.educause.edu/ir/library/pdf/pub3102.pdf. 

31 Carol Livingstone, Mike Corn & Lisa Huson, University of Illinois Social Security Number 

Policy Implementation , Jan. 10, 2001, at http://www.ssn.uillinois.edu/assets/applets/ 

UIUC SSN Presentation 1 10 2002.pdf; Andrea L. Foster, U. of Illinois May Be a Model 

in Protecting Privacy, Chronicle of Higher Education, Aug. 2, 2002. 

32 Testimony of David S. Miller, Director, Health System Services, UHC, on the Unique Pa- 
tient Identification Number at the National Committee on Vital Health Statistics hearing in 
Chicago, Jul. 21, 1998, at http://www.cchconline.org/privacy/uhc.php3. 



58 


SSN on insurance cards. According to IBM, fifteen insurers, which cover about 
30,000 of the company’s 500,000 employees worldwide have either not responded or 
indicated that they will not comply with the request. 33 

SSN Required for Access to Products, Services 

Major companies, including Blockbuster, Sam’s Club and Costco continue to de- 
mand the SSN and other unnecessary information on their applications for access 
to products and services. 34 

SSN Litigation Has Yielded Mixed Results for Privacy Protection 

In February 2002, the New Hampshire Supreme Court ruled for the first time 
that New Hampshire State residents can sue companies that sell their personal 
data or SSN, or obtain their work address through the use of pretextual phone 
calls. 35 The Court found that the sale of such data was actionable if it subjected 
a person to foreseeable harm. It also ruled that people have a reasonable expecta- 
tion of privacy in their SSNs, even though SSNs must be disclosed in certain cir- 
cumstances. The ruling clears the way for a trial against Docusearch, the informa- 
tion broker who sold the SSN, home and work address of Amy Boyer to the man 
who stalked and murdered her. 

In September 2002, the Fourth Circuit held that individuals cannot recover dam- 
ages under the Privacy Act without a showing of actual harm. 36 This ruling is in 
conflict with the law in several other circuits, and the Supreme Court has granted 
certiorari in the case. In Doe v. Chao , the Department of Labor used individuals’ 
SSNs to identify their compensation claims. As a result, the SSNs were cited in pub- 
lic records and are now widely available. Although the plaintiff was embarrassed 
and placed at risk as a result of the disclosure, the Fourth Circuit held that one 
needs other manifestations of emotional distress in order to prove that harm oc- 
curred. We believe that the Fourth Circuit improperly interpreted the damages sec- 
tion of the Privacy Act, and we plan to file an amicus brief with the Supreme Court 
in support of the plaintiff. 

In June 2003, a federal judge in Detroit ruled that the Privacy Act creates a pri- 
vate right of action for violating procedural rules relating to SSNs, but only as they 
apply to federal agencies, not states or municipalities. 37 Judge Anna Taylor dis- 
missed a suit seeking Privacy Act damages from the City of Detroit after its con- 
tractor mailed tax forms to residents with their SSNs printed on the mailing label. 
The Judge stated that plaintiff Daniel Schmitt failed to show that he was adversely 
affected or that Detroit acted willfully or intentionally because like the IRS, most 
local and State tax authorities request SSN for taxpayer identification purposes. 
The City vowed to keep SSNs off labels and attach a disclosure statement to the 
tax forms about SSNs, as required by the Privacy Act. 38 

SSNs Are Being Used for Political Protest 

California-based Foundation for Taxpayer and Consumer Rights posted partial 
SSNs of state legislators who voted in opposition of privacy legislation. 39 The group 
purchased the SSNs online for $26, demonstrating that access to sensitive informa- 
tion is convenient and inexpensive. 

In June 2003, the Attorney General of Washington State decided not to defend 
a law designed to prohibit a web site that posts the names, addresses and home- 
phone numbers of police in Western Washington. As a result, Bill Sheehan III of 
Mill Creek is free to continue publishing his web site, www.justicefiles.org, which 
includes names and salaries of many Western Washington police officers and in 
some cases their SSNs, birth dates, home addresses and phone numbers. Sheehan 
claims that publishing such information is the best way to hold law-enforcement of- 
ficers accountable to the public. 40 
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States Innovating Solutions 

California’s Senate Bill 1386 went into effect on July 1, 2003. 41 That legislation 
requires companies that maintain SSNs and other personal information to notify in- 
dividuals when they experience a security breach. The bill came in response to an 
April 2002 incident in which the records of over 200,000 state employees were 
accessed by a computer cracker. The California legislation exceeds federal protec- 
tions, as there is no national requirement for notice to individuals when personal 
information is accessed without authorization. 

More specifically, the legislation creates a notice requirement where there has 
been an unauthorized acquisition of an individual’s name along with a Social Secu- 
rity Number, a driver’s license number, or an account number and corresponding 
access code. The notice requirement is also triggered when there is a reasonable be- 
lief that a security breach occurred. Notice must be given “in the most expedient 
time,” but may be delayed where it would impede a criminal investigation. 

Although this state law does not directly regulate collection or use of the SSN, 
it is likely to provide more privacy for Californians. The legislation places new re- 
sponsibilities on those who collect the SSN, as a result, businesses are more likely 
to avoid collecting the SSN. 

III. Recommendations 

107 H.R. 2036, The Social Security Number Privacy and Identity Theft Protection 
Act of 2001, was a good proposal. This Congress should revisit and pass this impor- 
tant bill. 

We recommend that the Committee visit the Social Security Number Privacy and 
Identity Theft Protection Act of 2001, 107 H.R. 2036, as a guide to limiting the use 
of the SSN. The measure was sponsored by Representative Clay Shaw (R-FL). In 
the 107th Congress, the bill enjoyed bi-partisan sponsorship of over 70 Members. 
The measure contained a comprehensive set of rights to protect individuals from 
identity theft. 

Title I of the bill would have established important protections against public-sec- 
tor sale or display of SSNs. These provisions will prohibit the display of the SSN 
on checks and government-issued employment cards. The bill would have prohibited 
disclosure of the SSN to inmates, and appearance of the SSN in public records. In- 
creasingly, public records are a source for the collection of personal identifiers that 
then can be reused for any purpose. 

The bill would have also prohibited “coercive disclosure” of the SSN — the practice 
of denying a product or service when an individual refuses to give a SSN. Addition- 
ally, Section 203 of that bill would have placed the SSN “below the line” on credit 
reports. This is an important and much needed protection that would stem traf- 
ficking in SSNs. 

Alternatively, we recommend that the Committee consider 108 H.R. 1931, the 
Personal Information Privacy Act of 2003. That bill was introduced by Representa- 
tive Kleczka (D-WI) in May and referred to the Committee on Ways and Means. 
H.R. 1931 would establish important protections for the SSN, including moving the 
SSN “below the line” on the credit report. The bill would also limit the use of “trans- 
action and experience” information, and require opt-in consent before credit or in- 
surance prescreening letters are sent. Such letters are a major source of the identity 
theft problem. Under the bill, aggrieved individuals have a private right of action 
against violators. 

IV. Conclusion 

Without a framework of restrictions on the collection and use of the SSN and 
other personal identifiers, identity theft will continue to increase, endangering indi- 
viduals’ privacy and perhaps the security of the nation. The best legislative strategy 
is one that discourages the collection and dissemination of the SSN and that encour- 
ages organizations to develop alternative systems of record identification and 
verification. It is particularly important that such legislation not force consumers 
to make unfair or unreasonable choices that essentially require trading the privacy 
interest in the SSN for some benefit or opportunity. 

It is important to emphasize the unique status of the SSN in the world of privacy. 
There is no other form of individual identification that plays a more significant role 
in record-linkage and no other form of personal identification that poses a greater 
risk to personal privacy. Given the unique status of the SSN, its entirely inappro- 
priate use as a national identifier for which it is also inherently unsuitable, and the 


41 http://www.leginfo.ca.gov/cgi-bin/postquery7bill number=sb 1386&sess=PREV&house= 
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clear history in federal statute and case law supporting restrictions, it is fully appro- 
priate for Congress to pass legislation. 

I am grateful for the opportunity to testify this afternoon and would be pleased 
to answer your questions. 


Chairman SHAW. We have your written testimony. It will be 
made part of the record, and it will be examined closely. Mr. Col- 
lins, will you introduce Mr. Edwards, please. 

Mr. COLLINS. It is my pleasure, Mr. Chairman, to introduce to 
you a fellow Georgian, Mr. Steve Edwards. Mr. Edwards joined the 
Georgia Bureau of Investigation in 1973. For the last 15 years, his 
work has focused specifically on financial investigations, health 
care fraud, and computer crime investigations. He has been on the 
National White Collar Crime Center Board since 1997, and now he 
is Vice Chairman, which represents southeast region States — West 
Virginia, Virginia, Kentucky, Tennessee, North and South Caro- 
lina, Georgia, and Florida, as well as Puerto Rico and the Virgin 
Islands. For his next trip to the Virgin Islands, he plans to take 
one of the Congressman from Georgia. He also served as a nego- 
tiator for Georgia Special Weapons and Tactics (SWAT) team. He 
is a coordinator of the U.S. Department of the Treasury’s Financial 
Crimes Enforcement Network, and he has just done a super job for 
Georgia, working in the Georgia Bureau of Investigation. Welcome, 
Mr. Edwards. 

STATEMENT OF STEVE EDWARDS, STATE COORDINATOR, FI- 
NANCIAL CRIMES ENFORCEMENT NETWORK, VICE CHAIR- 
MAN, BOARD OF DIRECTORS, NATIONAL WHITE COLLAR 
CRIME CENTER, RICHMOND, VIRGINIA, MEMBER, GEORGIA’S 
STOP IDENTITY THEFT NETWORK, CHAIR, INFRAGARD AT- 
LANTA CHAPTER WATCH AND WARN COMMITTEE, AND SPE- 
CIAL AGENT IN CHARGE, FINANCIAL INVESTIGATIONS UNIT, 
GEORGIA BUREAU OF INVESTIGATIONS, DECATUR, GEORGIA 

Mr. EDWARDS. Thank you, Mr. Collins. It is a pleasure to be 
here, and I am a little overwhelmed by that introduction. I don’t 
deserve that, but thank you very much. Thank you, too, Chairman 
Shaw, for the opportunity to address the Subcommittee concerning 
identity theft. What I would like to talk about or take the oppor- 
tunity to discuss is the Georgia Stop Identity Theft Network, and 
some of the reasons that we formed that network. A primary com- 
plaint of victims of identity theft is that they are unable to get sat- 
isfaction. They are often unable to find an agency or an organiza- 
tion that is willing to assume responsibility for helping them to 
deal with the crime they have experienced. Victims of identity theft 
also have difficulties with legal jurisdiction. For example, if a vic- 
tim who resides in Georgia is confronted with identity theft that 
occurred in California, local law enforcement in Georgia may tell 
them that they do not have jurisdiction or they are not a victim. 
To address this problem, Georgia and some other States, a few 
other States, require that a police report be generated for all re- 
ported cases of identity theft. This police report is a useful tool for 
the victim when reporting a violation to other organizations. In es- 
sence, a primary need for victims of identity theft is a one-stop 
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shop, whether physical or online. The Stop Identity Theft Network 
in October 2002 actually developed and created and put online a 
complaint program. Since that program has been in existence, we 
have had 233 complaints processed through it. 

The way it works is after the victim files a complaint, the net- 
work submits the complaint to the cities, counties, and State law 
enforcement having jurisdiction or venue. Not only in the State of 
Georgia, but across the country. Along with the complaint is a let- 
ter explaining to the agency what it means and the other agencies 
that have received the same complaints so they can coordinate 
their efforts. In the past 30 years, I have been a Georgia Bureau 
of Investigation agent. I have seen no other crime directly affect 
more friends, associates, and family members than identity theft. 
Since 2000, when I became actively involved in the development of 
the Stop Identity Theft Network, I have received an average of two 
or three telephone calls per month from someone I know who has 
been a victim of identity theft. The illegal use of SSNs is key to 
laying the groundwork to take over someone’s identity. Contain- 
ment of widespread use of SSNs could have a substantial impact 
in the prevention of identity theft. This containment is important 
not only in areas of government, but the use of SSNs as individual 
identifiers within the private sector as well. Examples of current 
broad use of SSNs — and this has already been discussed, but I will 
say it again — driver’s license, student records, bank accounts, util- 
ity services, insurance policies, credit bureau records, cash checking 
services, medical services, apartment rental, employment, member- 
ship, and even in some areas library access. 

While it may not be feasible to restrict the use of SSNs to admin- 
ister Social Security taxation, it is recommended that SSNs be re- 
stricted for other uses. The development of these restrictions is ap- 
propriately the responsibility of Congress and consistent with other 
privacy measures, particularly in the absence of uniform aggressive 
action among State and local governments, as well as the private 
industry, to reduce opportunities for identity theft. In those in- 
stances where SSNs are deemed suitable for recording their exist- 
ent need to create statutory incentives for organizations to safe- 
guard this information. While few States have some form of ac- 
countability already on the books, there is no uniformity. In addi- 
tion, creating a statutory category of liability would serve both to 
increase the victim’s chances in civil court and to put the organiza- 
tions on notice to change their behavior. It has been recognized 
that no Federal law currently limits use or disclosure of SSNs 
among private entities. The SSA cannot control how private enti- 
ties keep use or distribute SSNs. Thus leaving the burden on the 
consumers who have no real power. Many bills responding to the 
problem of identity theft have been introduced in recent Con- 
gresses, and several are again pending. These bills, such as H.R. 
2036 which you sponsored in the 107th Congress, Mr. Chairman, 
would enhance privacy protection and otherwise help prevent 
fraudulent misuse of SSNs. As you know, other measures are pend- 
ing in the Congress to protect personal identifiers. While we are 
not necessarily endorsing every aspect of these various measures, 
we certainly commend them to your careful consideration as Con- 
gress acts along with the States to better enable effective responses 
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and efforts to prevent identity theft. Thank you, and thank you Mr. 
Collins, for the opportunity to testify before you today; I am eager 
to answer any questions you or other Members of the Sub- 
committee have. Thank you all. 

[The prepared statement of Mr. Edwards follows:] 

Statement of Steve Edwards, State Coordinator, Financial Crimes Enforce- 
ment Network, Vice Chairman, Board of Directors, National White Collar 
Crime Center, Richmond, Virginia, Member, Georgia’s Stop Identity Theft 
Network, Chair, Infragard Atlanta Chapter Watch and Warn Committee, 
and Special Agent in Charge, Financial Investigations Unit, Georgia Bu- 
reau of Investigations, Decatur, Georgia 

Chairman Shaw and members of the subcommittee, thank you for this oppor- 
tunity to address this subcommittee concerning the subject of identity theft. 

Introduction 

My name is Steve Edwards, and I am Special Agent in Charge of the Financial 
Investigations Unit of the Georgia Bureau of Investigations (GBI), State Coordinator 
to the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN), and Vice 
Chairman on the Board of Directors of the National White Collar Crime Center 
(NW3C). In addition, I am a committee member on the State of Georgia’s STOP 
IDENTITY THEFT Network and serve as chair on the FBI’s InfraGard Atlanta 
Chapter Watch and Warn Committee. 

GBI is an independent, state-wide agency that provides assistance to Georgia’s 
criminal justice system in the areas of criminal investigations, forensic laboratory 
services and computerized criminal justice information. 

NW3C is a non-profit corporation that provides a national support network for 
law enforcement agencies, state regulatory bodies, state and local prosecution of- 
fices, and other organizations involved in the prevention, investigation, and prosecu- 
tion of high-tech and economic crime. 

Overview of the Problem: On-the-ground Perspective 

I would like to take this opportunity to briefly discuss Georgia’s STOP IDENTITY 
THEFT (STOP I.T.) Network and some of the reasons for its formation. A primary 
complaint of victims of identity theft is, in my experience, that they are unable to 
“get satisfaction.” By this I mean that they are often unable to find an agency or 
organization that is willing to assume responsibility for helping them to deal with 
the crime they have experienced. As a result, victims needlessly contact one organi- 
zation after another in an effort to handle the violation, and may, in the end, receive 
no assistance at all. In many cases, for example, local law enforcement tell victims 
of identity theft, “you are not a victim” — particularly if the victim has suffered no 
direct financial loss. Their advice is often that the victim should contact the organi- 
zation that was used for the perpetration. The organization involved, in turn, refers 
the victim to local law enforcement. 

Victims of identity theft also have difficulties with the matter of legal jurisdiction. 
For example, if a victim who resides in Georgia is confronted with identity theft that 
has resulted in a violation in California, local law enforcement in Georgia may state 
that they do not have jurisdiction. To address this problem, Georgia, and other 
states, require that a police report be generated for all reported cases of identity 
theft. This police report is a useful tool for the victim when reporting the violation 
to other organizations, such as a credit bureau. Unfortunately, other factors — in- 
cluding lack of resources — often prevent local law enforcement from taking action 
beyond the generation of a report. 

In essence, a primary need for victims of identity theft is a “one-stop-shop,” or a 
single “location” — whether physical or online — where victims can receive informa- 
tion about identity fraud prevention, file a complaint, and receive guidance con- 
cerning recovery from identity theft violations. In 2000, Georgia’s STOP I.T. Net- 
work was conceived as such a location. In October 2002, STOP I.T. went online for 
the first time, and since then 233 complaints have been received and processed. 

After receiving a complaint from a victim, STOP I.T. serves as an intermediary 
between the victim and a number of agencies. For example, a complaint from a vic- 
tim in Georgia is forwarded by STOP I.T. to city, county and state law enforcement 
appropriate to the complaint; to local and state law enforcement in any state where 
the victim identifies activity associated with the identity theft; to the FTC; and to 
the Internet Fraud Complaint Center. In addition, STOP I.T. sends to each organi- 
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zation a letter of explanation that includes a list of every other organization that 
has received the complaint. Finally, victims receive information to assist them in 
protecting against the continued fraudulent use of their personal information and 
in recovering financial and other losses that have resulted from the violation. 

In the 30 years that I have been involved in financial crime, I have seen no other 
crime directly affect more friends, associates, and family members than identity 
theft. Since 2000, when I became actively involved in the development of STOP I.T., 
I have received an average of 2 or 3 telephone calls per month from someone I know 
who has been a victim of identity theft. Data collected across the nation — to the ex- 
tent that data on identity theft exist — also indicate that identity theft is a crime 
that is pervasive and expanding rapidly. 

Overview of the Problem: Broad Perspective 

Identity theft — or the use of “another person’s personal information in some way 
that involves fraud or deception” 1 — is currently one of the fastest growing crimes 
in the United States. 2 Two of the most common forms of identity theft include “true 
name fraud” and “account takeover fraud.” 3 True name fraud occurs when someone 
uses an individual’s personal information to open a new account, and account take- 
over involves illegal access to an individual’s existing account for the purpose of 
making fraudulent charges against the account. Identity theft is also used to facili- 
tate other crimes — including money laundering, bankruptcy fraud, computer crimes, 
and acts of terrorism — by providing a means of concealing the identity of the crimi- 
nal and accessing funds or privileges available to the victim. It is important to note, 
however, that financial loss is not a necessary component of identity theft. “Crimi- 
nal identity theft,” for example, occurs when a victim’s personal information is used 
by a criminal and subsequently associated with records of criminal violations, out- 
standing arrest warrants, or other public information without the knowledge of the 
victim. 

The Federal Bureau of Investigation (FBI) and other law enforcement agencies 
have estimated that between 700,000 and 1.8 million Americans are victimized by 
identity theft each year — a figure that has increased substantially in recent years. 
In addition, recent surveys (conducted by Star Systems, a national electronic pay- 
ments network) indicate that about 1 in 20 adults in the United States, or about 
12 million Americans, have been victimized by identity theft at least once. 4 

In 2002, the number of identity theft cases reported to the Federal Trade Commis- 
sion (FTC) rose to 161,819 — almost twice the number reported in 2001. 5 Other cases 
were reported directly to local law enforcement; reported to other federal agencies, 
including the FBI, Secret Service, Internal Revenue Service, and Postal Inspection 
Service; or never reported at all. 

The cost of identity theft to businesses has been estimated to be more than $11.9 
billion each year. 6 The costs to victims of this crime include loss of credit, harm to 
reputation, and loss of wages, in addition to the direct loss of money, attorney fees 
and other recovery expenses. Despite these losses, and the considerable attention 
that has been paid to the problem in recent years, the average arrest rate for all 
identity theft cases reported by victims remains around 5 percent. 7 

Identity Theft and the Use of Social Security Numbers 

Since the illegal use of social security numbers (SSNs) “is key to laying the 
groundwork to take over someone’s identity,” 7 containment of the wide-spread use 
of SSNs could have a substantial impact on the prevalence of identity theft in the 
future. This containment is important not only in areas of government that use 
SSNs as individual identifiers, but also in private organizations, which are increas- 
ingly including SSNs on personal records and distributing this information for a va- 
riety of purposes. Examples of the current broad use of SSNs include 

• Driver’s Licenses : As many as eleven states and the District of Columbia cur- 
rently display the SSN on the face of their drivers’ licenses. Several other states 
require a SSN for the issuance of a driver’s license but do not display the num- 
ber on its face. 

• Student Records : Half of colleges and universities use SSNs to identify students, 
and 79% include them in official transcripts, according to a March 2002 survey 
by the American Association of Collegiate Registrars and Admissions Officers. 

• Other Records'. A SSN is often required or requested for services such as bank 
accounts, utility services, insurance policies, check cashing services, medical 
services, apartment rental, extension of credit, employment, memberships, and 
library access. SSNs are also used as reference numbers for credit bureau re- 
ports, which are widely distributed, often without the knowledge of the credit 
holder. 
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While it may not be feasible to restrict the use of SSNs to the administration of 
Social Security taxation, for which it was originally designed, it may be feasible to 
restrict the use of SSNs to a set of identified purposes for which there is a legiti- 
mate legal reason to collect a SSN. In addition, government agencies and businesses 
that collect SSNs can be required to restrict access to SSNs — by employees and 
other organizations — and to dispose of records that include SSNs using specified 
procedures, e.g., encrypting personal information on databases and shredding paper 
documents containing personal information. 

The development of these restrictions is appropriately the responsibility of Con- 
gress, and consistent with other privacy measures recently passed, particularly in 
the absence of uniform, aggressive action among state governments, local govern- 
ments, and private industry to reduce opportunities for identity theft. In addition, 
the increasing number of cases being pursued by law enforcement throughout the 
country evidence the immediate importance of developing these restrictions. For ex- 
ample, 

• July 1 and 2, 2003, Consuelo Onate-Banzon and Rony Razon, and four other 
individuals, were arrested on charges of identification and social security fraud. 
According to the FBI, Onate-Banzon and Razon worked for the Virginia Depart- 
ment of Motor Vehicles (DMV) and allegedly produced and sold as many as 
1,000 fraudulent Virginia driver’s licenses, with the help of co-conspirators. 8 

• On May 8, 2003, Dorian Thomas, age 27, was indicted on charges of conspiracy, 
bank fraud, and identity theft. Thomas, an employee of a financial institution 
in California, had “obtained the confidential member profile information of ac- 
count holders through financial institution computers and provided it to oth- 
ers,” 9 who then completed more than $100,000 in fraudulent bank trans- 
actions. 10 

• Charmaine Northern, age 23, “pled guilty on March 10, 2003, to obtaining con- 
fidential customer account information from the computer at the financial insti- 
tution where she was working and using it to open credit card accounts and 
incur unauthorized charges estimated to be approximately $50,000.” 13 

• Kimberly Smart, age 27, was sentenced on December 5, 2002, “in connection 
with using her financial institution position to obtain customer account informa- 
tion from the financial institution computer and provide it to others.” 11 The 
losses incurred in this case were approximately $121,146.63. 

• Philip Cummings, a 33-year-old former “help desk” employee of Teledata Com- 
munications, Inc., faced charges on November 26, 2002, of accessing credit bu- 
reau databases, selling confidential information, and participating in a fraud 
scheme that resulted in a loss of more than $2.7 million to 30,000 victims. 12 

• Ivy Johnson, a former employee of H & R Block in White Plains, New York, 
was charged in January 2003, for obtaining customers’ personal information, 
and using the information to divert tax checks, open new credit card accounts, 
and making ATM withdrawals in victims’ names. 13 

All of these cases involved access to and use of SSNs. Future cases of similar vio- 
lations may be reduced if requirements for specific safeguards are mandated and en- 
forced by federal statute. In addition to legislative restrictions, education and train- 
ing is also important for the reduction of identity fraud in the future. This education 
and training should include 

• Educating individuals to take active steps to protect their personal information; 

• Training state and local law enforcement to identify and effectively handle iden- 
tity theft cases, since these cases are often first reported to state and local rath- 
er than federal law enforcement agencies; and 

• Educating businesses, including banks and credit bureaus, to guard against and 
detect identity theft. 

“Best Practices” to Combat Identity Theft 

The following is an analysis of best practices either currently in place in the 
states or needed to fulfill assistance functions for victims of identity theft. These 
conclusions were generated through a synthesis of published commentaries and cri- 
tiques of existing legislation, peer-reviewed academic articles, and analysis of pend- 
ing legislation. 

First, it is important to use a broad definition that explains the substance of the 
sort of information that should be considered “identifying information.” This defini- 
tion should be broad enough to include account numbers, scanned or re-encoded 
credit or account access cards, and SSNs. Following the establishment of a working 
definition of the problem, the research of NW3C has indicated that there are numer- 
ous opportunities to help victims of identity theft. 



65 


Practice 1: Explicit recognition of identity theft as a crime committed against the 
individual. 

States have taken a variety of approaches to dealing with identity theft victims. 
Chief among the issues that create inconsistencies among states is the nature of vic- 
timization in identity theft cases. For example, victims in states that do not recog- 
nize identity theft as a crime must often seek assistance through civil suits or ancil- 
lary charges. While the place of the civil suit is to rectify injustices that escape the 
criminal justice system, it is an arduous task least likely to be pursued by most peo- 
ple. Such circumstances exemplify a need for legislation that explicitly criminalizes 
the dissemination and misuse of identifying information such as SSNs rather than 
just the theft facilitated by information misuse. Specifically, statutory frameworks 
should explicitly criminalize identity theft in a manner that clearly underscores the 
method of information obtainment, as well as monetary damages. 

Practice 2: Eligibility of identity theft victims for victims’ rights assistance. 

The foremost need expressed by victims in recent NW3C research is for notifica- 
tion of victimization. Indeed, the most comprehensive framework for protecting the 
rights of victims and restoring them to their pre-victimized state is of little use if 
victims do not know that a crime has been committed. This is especially true in the 
instance of a SSN that is stolen from medical or business documents without the 
knowledge of the victim. 

In states that do recognize the individual whose identity has been stolen as an 
injured party, the degree of victimization is often deemed to be trivial in comparison 
to other offences, especially violent ones. In some states, victims’ assistance and, in 
some cases basic notification and participation rights, are denied to victims of prop- 
erty crime and only afforded to those who can demonstrate some form of physical 
injury. In other states, victims of non-violent crimes are only given full protection 
if the predation is judged to be a felony offence. It is therefore of great importance 
that those statutes that exist to aid crime victims recognize the victims of identity 
theft as targets of a serious crime who may require assistance in pulling their lives 
back together. 

Practice 3: Phasing out use of private identifying information on non-secure 
documents. 

While many states no longer use SSNs as identifiers on drivers’ licenses, these 
numbers are still widely used on non-secure public documents. For example, many 
schools that use SSNs as student identification numbers include these numbers on 
a variety of forms and correspondence, and order forms and applications often solicit 
personal information. Consequently, a Nexis public records search can reveal SSNs 
and dates of birth in seconds. Additionally, organizations that accumulate personal 
information apply varying levels of security. Ultimately, it is unhelpful for a dozen 
organizations to strictly protect personal information if only one organization makes 
that information publicly available. This issue is associated with the idea of liability 
for breaching a duty of confidentiality, but it is also a change in focus that requires 
unique legislative attention. In other words, it is important not only to protect per- 
sonal information but also to establish safeguards for handling those forms that doc- 
ument personal information. What is required is legislation that mandates strict 
controls on the circumstances under which the recording of personal information is 
justified. 

Practice 4: Eligibility for compensation and financial assistance. 

Financial assistance is typically reserved for victims of violent crimes where the 
perpetrator has not been ordered to provide restitution or does not have the means 
to provide effective restitution. Such practices can also be helpful in identity theft 
cases that result from privacy breaches. Financial assistance, unlike restitution, is 
able to provide for and compensate immediate financial outlays without concern for 
the offender’s ability to pay. As the Privacy Rights Clearinghouse has demonstrated, 
a victim of identity theft typically spends as much as $1,200 out-of-pocket to correct 
the damage caused by the crime. Thus, just as victims of violent crimes have a need 
for funds to cover immediate emergency expenses, so do victims of identity theft. 
Therefore, legislation may be needed to assure that victims of identity theft can 
qualify for federal victim assistance funds. 

Practice 5: Aid to identity theft victims in clearing their names. 

Regardless of the efficiency of the legal system in prosecuting identity theft cases, 
victims often face many difficulties in removing fraudulent information that is asso- 
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dated with their names. Consequently, victims of identity theft remain vulnerable 
to future victimization through the continued use of their SSN on government docu- 
ments, most of which require the use of the SSN as a personal identifier. A great 
need exists for aid in purging erroneous records maintained by credit bureaus, po- 
lice departments, and other organizations that result from the crime of identity 
theft. Often, the mechanism for such corrections is complex, creating barriers for 
citizens of limited means or comprehension. Therefore, legislative guidance for aid 
to victims of identity theft would be helpful. Examples of policies that have been 
enacted by statute (nearly all from California) to address this problem are 

• Providing public agency aides to assist victims by making phone calls, preparing 
forms, or taking other steps on behalf of the victims; 

• Requiring that court records reflect that the person whose identity was falsely 
used to commit a crime did not commit that crime (Cal. Penal Code 530.5(c)); 
and 

• Allowing the victim to petition the court for an expedited determination of fac- 
tual innocence (Cal. Penal Code 530.6). 

Legislative Treatment of Social Security Information 

In those instances when SSNs are deemed suitable for recording, there exists a 
need to create statutory incentives for companies (especially, but not limited to, 
credit card companies) to safeguard this information. While a few states have some 
form of accountability already on the books (California’s Information Practices Act 
and Delaware’s concept of reckless disclosure of information stand out), none have 
gone so far as to explicitly create an actionable duty of care for all entities that col- 
lect private identifying information to protect said information to at least the level 
to which a reasonable person would have protected it. Delaware is the only state 
to even mention the reckless or negligent disclosure of personal information in their 
identity theft legislation. 

While civil actions are always available to punish such disclosures, they do not 
possess the desired deterrent effect unless they are easily factored into a rational 
analysis of policy options. As it stands, one can only assume that the current rate 
of identity theft and credit card fraud are an acceptable cost of business for the cor- 
porations that currently treat with social security numbers and other private identi- 
fying information in an unsafe way. Creating a statutory category of liability would 
serve both to increase the victim’s chances in court and to alter the equation for 
those corporations, putting them on notice to change their behavior lest it eat into 
their profit margin. 

California is one state that has imposed liability on entities that handle personal 
data. Cal Civ Code § 1798.29 (2003), for example, requires any agency that “owns 
or licenses computerized data that includes personal information” to report security 
breaches to the people whose personal information may have been compromised. Cal 
Civ Code § 1798.82 (2003) extends similar requirements to people and businesses 
doing business in California. This approach is proposed for Federal law in S. 1350, 
the Notification of Risk to Personal Data Act, recently filed by Senator Feinstein. 

Of course, regardless of how rigorously SSNs are protected, there will be instances 
in which they are abused. On this matter, the following recommendations are pro- 
posed: 

• Make possession of fraudulent social documents either illegal in and of itself or 
allow it to create a permissible inference of forgery. There is already a provision 
in many forgery and credit card fraud statutes that states that the ownership 
of some small number of forged or unauthorized instruments is enough to create 
an inference of a guilty motive without the necessity of proving a definite in- 
tent. Additional measures can be taken to address unauthorized possession of 
identifying documents or information. Some states have already adopted various 
measures of this type. Alabama and Kentucky lead the way in this regard, and 
set the required number of identity documents (a term that would include social 
security cards) in one’s possession that are not one’s own to create an inference 
of identity trafficking at five. 

• When SSNs are abused, they are often abused for long periods of time. While 
a victim of a burglary may change their locks, a victim who was targeted 
through their SSN has little ability to prevent this means of victimization in 
the future. Unless SSNs are easily changed, the victims of these crimes have 
little protection against repeat predation, especially as the SSN is passed to 
other unscrupulous types. To address this problem, some sort of repository for 
compromised SSNs, which could flag SSNs that have been the target criminal 
abuse, could be established. 
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Current Legislative Issues 

It has been recognized that no federal law currently limits use or disclosure of 
SSNs among private entities, leaving them free to deny credit or services without 
SSNs; and that the Social Security Administration (SSA) cannot control how private 
entities keep, use or distribute SSNs, thus leaving the burden on consumers who 
have no real power. 14 

Many bills, taking a variety of approaches to preventing or enhancing responses 
to identity theft, have been introduced in recent Congresses, and several are again 
pending in this, the 108 th Congress. Some of these legislative measures propose en- 
hancements in the penalties under the federal ID Theft statute in the interest of 
increasing the deterrent effects, or would make modifications aimed at facilitating 
investigations or prosecutions. Others go more directly to the topic at hand today: 
augmenting the protections against disclosure and misuse of certain information, in- 
cluding SSNs. 

These bills, such as H.R. 2036 which you sponsored in the 107 th Congress, Mr. 
Chairman, would enhance privacy protections and otherwise help prevent “fraudu- 
lent misuse” of SSNs by restricting display or use of SSNs, restricting dissemination 
of SSNs or any derivative or their use as PINs without an individual’s consent, and 
providing for regulation and criminal punishment of sales and purchases of SSNs. 
As you know, measures are also pending to protect other personal identifying infor- 
mation by, for example, prohibiting sale and disclosure of personally identifiable in- 
formation by commercial entities to non-affiliated third parties absent prescribed 
procedures for notice and opportunity to restrict such disclosures. 

Specifically, 

• H.R. 70, the Social Security On-line Privacy Protection Act, would prohibit an 
interactive computer service from disclosing to a third party an individual’s 
SSN or related personally identifiable information without the individual’s prior 
informed written consent. 

• H.R. 220, the Identity Theft Prevention Act of 2003 pending before this sub- 
committee, would, among other things, amend the Social Security Act and In- 
ternal Revenue Code to protect the integrity and confidentiality of SSNs, pro- 
hibiting their use or disclosure except for specified social security and tax pur- 
poses. 

• H.R. 637, the Social Security Number Misuse Prevention Act, and the com- 
panion bill, S. 228, would, among other things, prohibit display, sale, or pur- 
chase of SSNs without affirmative, express consent of the persons to whom they 
belong; prohibit use of SSNs on government-issued checks, the appearance of 
SSNs on driver’s licenses or motor vehicle registrations, and inmate access to 
SSNs; prohibit commercial entities from requiring individuals to provide SSNs 
when making purchases or from denying such purchases if the persons refuse 
to provide such numbers; and establish civil and criminal penalties for misuse 
of SSNs. (Similar provisions are included within other, broader bills, including 
but not limited to S. 745, the Privacy Act of 2003.) 

• H.R. 1931, the Personal Information Privacy Act of 2003, would, in part, pro- 
hibit commercial acquisition or distribution of SSNs, or derivatives, as well as 
their use as personal identification numbers, without written consent. 

Two other bills very recently filed in the House of Representatives and pending 
before the Ways and Means Committee, H.R. 2617, the Consumer Identity and In- 
formation Security Act of 2003, and H.R. 2633, the Identity Theft Protection and 
Information Blackout Act of 2003, include (but are not limited to) provisions that 
would similarly place prohibitions or restrictions on certain uses of SSNs. 

While we are not necessarily endorsing every aspect of these various measures, 
we certainly commend them to your careful consideration as Congress acts, along 
with the states, to better enable effective responses and efforts to prevent identity 
theft. 

Conclusion 

Thank you for the opportunity to testify before you today. Mr. Chairman, I am 
eager to answer any questions you or other members of the subcommittee may wish 
to direct to me. 
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Chairman SHAW. Mr. Collins. 

Mr. COLLINS. Thank you. Mr. Edwards, there has been talk 
about the Inspector General, the SSA having statutory authority to 
share information with law enforcement. How often have you re- 
quested information from SSA to pursue a criminal? 

Mr. EDWARDS. On several occasions, Mr. Collins, but in each 
case it was denied to me. 

Mr. COLLINS. What was the reason given? 

Mr. EDWARDS. At the time, and this is not in the most recent 
past, but at the time I was told that they could not provide that 
information. Basically, the information I have been able to obtain 
from Social Security over the years is, I can give them a number 
and they will tell me if it is a valid number or not. They will not 
tell me who the number belongs to or whether it is being used by 
the correct person. 

Mr. COLLINS. How long ago has it been since your last request? 
Do you know? 

Mr. EDWARDS. Within the last couple of years? Yes, sir. It has 
not been in the recent past; quite frankly, because of the frustra- 
tion, unless I just need a verification of a SSN, I rarely call them. 
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Mr. COLLINS. The Inspector General stated in its testimony 
that we need criminal penalties for Social Security misuse itself, as 
well as civil monetaries. You mentioned that possession of fraudu- 
lent documents should be illegal in and of itself. Describe some 
cases where such law would have been helpful in investigating or 
prosecuting an identity theft. 

Mr. EDWARDS. Identity theft covers a lot of different crimes, 
and there is a lot of crimes that are predicate acts to identity theft. 
So, we have used all kinds of charges, including false writings to 
the State for driver’s license. We have used it in cases where an 
individual has actually falsified a signature to obtain a credit card 
or some kind of bank loan or something along that line. So, all of 
these different tools that exist out there are very useful to us. We 
have an identity theft statute in the State of Georgia, and where 
it has helped our victims, and that is who it really helps, is giving 
them a vehicle for when. Particularly, like the scenario I gave 
where the identity was compromised in California, under Georgia 
law we can indict that individual and extradite them back, and 
there doesn’t have to be a financial loss, just the virtue that an in- 
dividual went around portraying that they were someone else using 
that individual’s identifiers in the State of Georgia is a crime now 
and it is a felony. It carries 5 years, and we are just starting to 
test that. It went into law a year ago, July, and we are just now 
starting to test that law in the courts. We have had a couple of 
cases that have been successful. 

Mr. COLLINS. How many other States have that? 

Mr. EDWARDS. I am not familiar, Mr. Collins. Quite frankly, 
maybe two or three. If that many. 

Mr. COLLINS. Thank you, Mr. Edwards. 

Mr. EDWARDS. Thank you, sir. 

Chairman SHAW. If I could direct a question to Mr. Wern and 
Mr. Hoofnagle with regard to, we have been hearing today a lot, 
people have been referring to the identifier as putting the genie 
back into the bottle. Obviously, the numbers are out there now, 
and they will remain out there no matter what we do. We can cer- 
tainly stop the distribution, or certainly retard the distribution 
through criminal statutes, but a lot of that information is already 
in the public domain. I know in Florida, with the total access that 
everybody has to public records, it is going to be very difficult to 
go back and take those numbers off of the public records. Whether 
you are talking about death certificates or probate files or it goes 
on and on, probably divorce files, I would assume they are probably 
in there somewhere, it is going to be very, very difficult. It occurs 
to me that if you simply prohibit the use of SSN as an identifica- 
tion for nongovernmental purposes, that it would make that num- 
ber somewhat useless for other purposes. Now, quite obviously if 
we were looking at this as an identifier, we would require very 
stringent requirements as to photographs or counterfeit proofing. 
You would have an address and date of birth and other pertinent 
information on the card itself, you would be sure to keep absolutely 
current with all of that, all of that information, and you would 
have had tremendous safeguards around it and everything else, 
which obviously the crooks have picked this up as something that 
was never anticipated by those who wrote the statutes. 
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I understand, Mr. Edwards, that we are looking into the area 
that you and Mr. Collins were just discussing with regard to the 
access law enforcement has, at least to the name, they are gov- 
erned under the Internal Revenue Code, there are restrictions on 
giving any information, but I think it is more based toward wages 
and things of this nature. We are going to look into it and see if 
it prohibits their giving the name of whomever, whatever number 
you have; or at least you should be able to say, I have got John 
Doe and he has got X-Y-Z number, is this his number? They 
should be able to say yes or no to that. So, we need to work on 
that. We use that number for so many number purposes. Tracking 
deadbeat dads. That was something I had a lot to do with in wel- 
fare reform when we reformed the welfare system in this country. 
We don’t want to make it more difficult to track deadbeat dads so 
they can fulfill their parental responsibilities. We do need, we des- 
perately need to stop the distribution of these numbers as an iden- 
tifier and as the golden, I think you, Mr. Hoofnagle, referred to it 
as the golden key or something of that nature, to stealing identi- 
fication. Mr. Wern, you mentioned that you were victimized and 
you went through this for about 3 years. I understand from people 
who have been in your place, that they are being warned that it 
may not be over, that this nightmare may recur. You have recur- 
ring nightmares in this area. How did they get your number, and 
was it the SSN that was the key to the identity theft that you suf- 
fered? 

Mr. WERN. We don’t know for absolute sure how the perpetrator 
got the number. He was caught and interrogated, but his story just 
didn’t make a whole lot of sense. My best guess, probably 80 per- 
cent sure, is that it was on a dental record that was stolen from 
my mail. I had some mail stolen, and one of the things that I know 
for a fact was stolen was a dental report or a bill that I know also 
had that SSN on it. My SSN was the key to that crime simply be- 
cause it was sort of the final piece of information he needed. It was 
easy enough to get my address. He knew where I lived, he took my 
mail. It was easy enough to get my name and date of birth as well 
from other public records. Once he had the SSN, he used it and 
damaged to the point, to the point where I actually had to change 
the SSN, which is an extreme measure that we don’t recommend 
people doing. It carries a lot of problems with it, but when you get 
to a situation where another person is essentially cloning you, you 
don’t have a choice. 

Chairman SHAW. Several things in the law that I want this 
Committee — that we will be looking at, is use of a counterfeit SSN. 
You have an illegal alien who is in this country, working. He gets 
a counterfeit Social Security card and number, the identification, 
and he can go to work. Then it is under a false number. Later he 
is legally admitted into the United States and gets a green card 
and gets a work permit. He can actually go back and claim the 
money that was paid into Social Security under that false number 
on his behalf, which to me is somewhat bizarre that somebody can 
go back and claim the fruits of their crime after they are entitled 
to work under the laws that we have. These are there are so many 
things that just don’t make a whole lot of sense, and the more you 
look into this whole use of SSNs and how they are used and 
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abused, it becomes more and more apparent that we definitely need 
to at least neuter the use of this number as an identifier so that 
if somebody does get hold of it, it will be sort of a, “so what.” One 
of the ways to do it is to just stop the nongovernment use of this 
number, period. Mr. Cardin, do you have any questions for these 
witnesses? 

Mr. CARDIN. First, let me thank you all for being here. I apolo- 
gize I was not here during your entire testimony. As more and 
more we talk about this, I am wondering, Mr. Chairman, how dif- 
ficult would it be to restrict the use of SSNs to governmental pur- 
poses and not in the private sector. It would require a lot of 
changes, the habits of the private sector. So, your comment was 
that the missing ingredient, that was the one bit of information 
that allowed the identity theft to be effective obtaining your SSN 
probably from a medical record that there was no need for it to be 
on. So, there is clearly an abuse in the private sector on the use 
of SSNs. It is convenient for them, it is a reliable number, it is set 
up by their government. I understand all those arguments as to 
why it is convenient to use the SSN for identification by the private 
sector, but that is not its intent. The other question about trying 
to verify who you are. The fact that you know someone’s SSN is 
no guarantee at all that that is who you are. So, I am just won- 
dering, Mr. Chairman, what is the trade-off here, how difficult it 
would be for the private sector if we in fact restricted those num- 
bers? I don’t have any specific questions for any of the witnesses. 
Again, I thank them for being here. 

Chairman SHAW. Well, I thank all of you for being here today. 
The first panel as well, which I neglected to thank as we ran out 
the door to make the last vote. I think it has been a very inter- 
esting discussion here, and the three of you certainly have added 
considerably to the store of knowledge that we are trying to build 
up. I am very hopeful that we will not only be able to get a bill 
out of this Committee, which I don’t think is going to be a great 
deal of trouble, I think we can do it, we have done it before but 
that we can work with the other committees to see that they move 
it. I think it is the Committee on the Judiciary and the Committee 
on Financial Services that have a piece of this legislation. There 
may be another jurisdiction involved, but everybody guards their 
turf up here on Capitol Hill, particularly this Committee. We really 
guard ours. We want to be sure that the other committees either 
waive jurisdiction or that they pass on the provisions of the bill 
within their jurisdiction. It is the fastest growing type of white col- 
lar crime that we have, and it may be the fastest growing crime, 
period. We know the conditions are getting worse and worse. Mr. 
Wern, we don’t want to see more people go through the agony that 
you went through. Credit is so important in this country. We cer- 
tainly appreciate the three of you coming forward. We are about 
ready to adjourn. Did you have anything? 

Ms. TUBBS JONES. Thank you gentlemen for coming. I am 
sorry I couldn’t be here, but you know what life is like on the Hill. 
Thank you, Mr. Chairman. 

Chairman SHAW. I was a judge too, Ms. Tubbs Jones. One time 
I came in late, in fact I came late a lot of times, and the bailiff 
looked over and he said, judge, you are late. I said, oh, did you 
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start without me? So, I think once you have been a judge, you kind 
of get used to your own time clock, and you do what you have to 
do. Well, thank you all very much. It has been a very beneficial 
hearing. We are now adjourned. 

[Whereupon, at 3:43 p.m., the hearing was adjourned.] 
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The Honorable E. Clay Shaw, Jr. 

Chairman 

Subcommittee on Social Security 
B-316 Rayburn House Office Bldg. 

Washington, DC 20515 

The Honorable Robert Matsui 
Ranking Democratic Member 
Subcommittee on Social Security 
1106 Longworth House Office Bldg. 

Washington, DC 20515 

Dear Chairman Shaw and Ranking Member Matsui: 

The undersigned organizations applaud your efforts over the past several years 
to craft legislation that will ensure the integrity of the social security number (SSN) 
in the years ahead. We are extremely concerned about the proliferation of identity 
theft and other financial crimes that exploit individual SSNs, and believe strong leg- 
islation should be enacted to combat such nefarious acts. We eagerly await your in- 
troduction of legislation to address these issues during this session of the 108 th Con- 
gress. 

As public and private employee benefit plan sponsors, however, we are concerned 
that such legislation could unintentionally hinder the delivery of benefits from, and 
the efficient administration of, public and private employee benefit plans. 

In your bipartisan legislation introduced during the 107 th Congress, the “Social 
Security Number Privacy and Identity Theft Prevention Act of 2001,” (H.R. 2036), 
the definitions and provisions relating to the “sale,” “purchase” or “display” of a per- 
son’s SSN could make it more difficult to deliver comprehensive health and retire- 
ment benefits to public and private employees alike. Indeed, the language could 
place plan administrators in jeopardy of, on the one hand, violating the strict fidu- 
ciary requirements applicable to retirement plans and, on the other hand, exposing 
themselves to criminal penalties under the bill. It is unreasonable to put plan ad- 
ministrators of a voluntary employee benefit system in this position. 

In general, public and private employee benefit plans use SSNs because they en- 
able the accurate and timely administration of benefits for a highly mobile work- 
force, and because use of the number is mandated for tax reporting requirements. 
Plan administrators take seriously the responsibility that the use of SSNs requires, 
and they use the utmost caution and security when SSNs are used in plan adminis- 
tration and communications. 

Public and private sector defined benefit and defined contribution pension and 
savings plans, like 401(k), 403(b), and 457 plans, use SSNs to identify plan partici- 
pants, account for employee contributions, implement the employee’s investment di- 
rections, track “rollovers” from other plans, and allow employees to view their ac- 
count activity or benefit accrual online (typically in conjunction with a secure 
“PIN”). The broad prohibitions of H.R. 2036 could impede, for example, an individ- 
ual’s ability to stay current on the accumulation of benefits for his or her retire- 
ment. 

SSNs are also used as the primary identifier in many medical and health benefit 
and prescription drug plans to coordinate communications between the doctor, the 
medical service provider, and the plan. H.R. 2036’s broad prohibitions could, for ex- 
ample, hinder the delivery of medications to the individual. 

H.R. 2036 allowed the nonabusive legitimate uses of social security numbers for 
national security, law enforcement, public health and advancing public knowledge 
purposes in proposed new section 208A(e) (section 201(a) of H.R. 2036). An “Employ- 
ment Exception” could be included as well. It would be substantially similar to that 
in S. 228, which exempts any interaction between businesses, governments, or busi- 
ness and government. The exemption appears in Section 3(a) of S. 228, creating Sec- 
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tion 1028A in Chapter 47, Title 18, United States Code. Senators Feinstein, Gregg, 
and Leahy introduced S. 228 on January 28, 2003. 

We firmly believe your legislation should permit the use of an individual’s SSN 
for any employment or employment-related purpose (such as the administration of 
an employee benefit plan) and for any recordkeeping purpose related to an invest- 
ment made by the individual. In H.R. 2036, you recognized the importance of this 
issue by specifically excluding application for government benefits or programs from 
the definition of “sale” or “purchase.” We believe our proposed “Employment Excep- 
tion” would follow your intent to not hinder the administration of employee pro- 
grams and delivery of benefits in the public and private sector employment arena 
as well. 

An “Employment Exception” could be included in the new section 208A(c) of the 
bill. Alternatively, the definitions of “sale,” “purchase” and “display” as drafted in 
new section 208A(a) (section 201(a) of H.R. 2036) could be modified and text in Sec- 
tion 202(b) of the bill could be slightly revised. We have attached proposed legisla- 
tive language that is designed to enable the bill to achieve your objective of limiting 
the misuse of social security numbers without interfering with the efficient and ef- 
fective administration of public and private employee compensation and benefit 
plans. 

We look forward to continuing to work with staff and with the Committee to effec- 
tively address the problem of identity theft without creating unintentional barriers 
to the provision of public and private pension, health and other benefits to employ- 
ees. Please do not hesitate to contact us should you require additional information 
or wish to discuss this issue in more detail. 


Sincerely, 


American Benefits Council 
American Society of Pension Actuaries 
College and University Professional Association for Human Resources 

ERISA Industry Committee 
Financial Executives International’s Committee on Benefits Finance 
National Association of State Retirement Administrators 
National Council on Teacher Retirement 
National Rural Electric Cooperative Association 
Profit Sharing/40 l(k) Council of America 


Proposed Amendments 

The undersigned organizations propose the following be included in the upcoming 
legislation to be introduced by House Ways and Means Social Security Sub- 
committee Chairman E. Clay Shaw, Jr., and Ranking Member Robert T. Matsui, 
which is designed to ensure the integrity of the social security number (SSN) in the 
years ahead. Our proposed amendments, which are based on the “Social Security 
Number Privacy and Identity Theft Prevention Act of 2001,” (H.R. 2036) introduced 
in the 107 th Congress, are designed to enable the bill to achieve its sponsors’ objec- 
tive of limiting the misuse of SSNs without interfering with the efficient and effec- 
tive administration of public and private employee compensation and benefit plans. 
In each instance, new text is underscored, and deletions are [bracketed]. 

Option 1 — Employment Exception 


Strike “and” after on Page 18, line 25. 

Replace with and,” on page 19, line 8. 

Insert at page 19, line 9: 

‘(8) if the display, sale, or purchase of such a number is for a use occurring as 
a result of an employment-related interaction between employers and employees of 
businesses or government (regardless of which party initiates the interaction), for 
any purpose mandated or permissible under Title 26 or Title 29 on the United 
States Code;' 
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Option 2 — Clarify Language to Prevent Unfair Treatment of 
Employee Benefit Plans 

PROPOSED AMENDMENTS TO SECTION 201: These amendments clarify that 
the prohibitions contained in Section 201 of the bill will not apply to public and pri- 
vate employer-sponsored plan uses of SSNs. These amendments also clarify that 
“government benefit or program” includes benefits related to employment with such 
governments. 

1. AMENDMENT DEFINING “SALE”: This amendment clarifies that an SSN is 
not sold when it is provided in connection with an employment-related trans- 
action that has a bona fide purpose unrelated to the use of the SSN, such as 
the administration of an employee benefit or compensation plan. 

Amend Section 208A(a)(2) (section 201(a) of H.R. 2036 defining “sale”) to 
read as follows: 

“(2) SALE — The term ‘sell’ in connection with a social security account number 
means to obtain, directly or indirectly, anything of value in exchange for such 
number. Such term does not include the submission of such number as part 
of the process for applying for any type of Government benefits or programs 
(such as grants or loans or welfare or other public assistance programs) or any 
activity necessary to effect an employment-related transaction that has a bona 
tide purpose unrelated to the use of the social security number." 

2. AMENDMENT DEFINING “PURCHASE”: This amendment clarifies that an 
SSN is not purchased when it is obtained in connection with an employment- 
related transaction that has a bona fide purpose unrelated to the use of the 
SSN, such as the administration of an employee benefit or compensation plan. 

Amend section 208A(a)(3) (section 201(a) of H.R. 2036 defining “purchase”) 
to read as follows: 

“(3) PURCHASE — The term ‘purchase’ in connection with a social security ac- 
count number means to provide, directly or indirectly, anything of value in ex- 
change for such number. Such term does not include the submission of such 
number as part of the process for applying for any type of Government benefit 
or programs (such as grant or loan applications or welfare or other public as- 
sistance programs), or any activity necessary to effect an employment-related 
transaction that has a bona fide purpose unrelated to the use of the social secu- 
rity number.'* 

3. AMENDMENT DEFINING “DISPLAY”: This amendment clarifies that an SSN 
is not displayed to the general public when it is placed in a viewable manner 
in connection with an employment-related transaction that has a bona fide 
purpose unrelated to the use of the SSN, such as the administration of an em- 
ployee benefit or compensation plan. 

Amend section 208A(a)(4) (section 201(a) of H.R. 2036 defining “display”) to 
read as follows: 

“(4) DISPLAY — The term ‘display’ means, in connection with a social security 
account number, the intentional placing of such number, or a derivative there- 
of, in a viewable manner on an Internet site that is available to the general 
public or in any other manner intended to provide access to such number or 
derivative by the general public. As used in this section, the term ‘general pub- 
lic’ does not mean any person connected with any activity that is necessary to 
effect employment-related transactions that has a bona fide purpose unrelated 
to the use of the social security number. 

PROPOSED AMENDMENTS TO SECTION 202: This amendment clarifies that 
an employee is not considered a consumer for purposes of this section and that sec- 
tion 202 of H.R. 2036 would not apply in the context of the employer-employee rela- 
tionship, such as the administration of an employee compensation or benefit plan. 

Amend section 202(b) as follows: 

“(b) EXCEPTION — Subsection (a) shall not apply to any person in any case in 
which such person is required under Federal law, in connection with doing 
business with an individual, to submit to the Federal Government such individ- 
ual’s Social Security account number; or, in connection with employment of the 
individual, including the provision of compensation or benefits thereof.'' 
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Rationale for Specific Changes in Option 2 

Section 201(c) unwisely subjects public and private employee benefit plans to reg- 
ulations promulgated by a federal agency with no expertise m employee benefit 
plans. Section 201(c) grants the Attorney General authority to promulgate regula- 
tions to carry out the prohibitions against sale, purchase, and display of SSNs, and 
provides the Attorney General complete discretion over whether or not to consult 
with an agency that has expertise over employee benefit plans. Regulations that re- 
quire the amendment of hundreds of thousands of public and private employee ben- 
efit plans should not be promulgated by an agency with no expertise or jurisdiction 
over the laws governing those plans. 

Section 202 could unintentionally restrict access to employee benefit plans. Sec- 
tion 202 prevents any "individual, partnership, corporation, trust, estate, coopera- 
tive, association, or any other entity” from refusing to “do business” with an indi- 
vidual who does not provide them with an SSN. Without clarifying that section 
202(a) does not apply to public and private employee benefit plans, plan sponsors 
might be prevented from obtaining an individual’s SSN for plan enrollment, benefit 
payments, and other legally mandated and routine plan administrative functions. 
The exemption in section 202(b) to this prohibition, while helpful, does not go far 
enough. 


Statement of Stuart K. Pratt, Consumer Data Industry Association 

The Consumer Data Industry Association (CDIA) is pleased to submit written tes- 
timony in connection with a hearing on the misuse of Social Security numbers and 
we thank Chairman Shaw for holding this hearing. CDIA has appeared in person 
before this subcommittee before and we hope our testimony will be helpful to you. 1 

Founded in 1906, the Consumer Data Industry Association (CDlA), formerly 
known as Associated Credit Bureaus, is the international trade association that rep- 
resents more than 500 consumer data companies. CDIA members represent the na- 
tion’s leading institutions in credit reporting, mortgage reporting, check verification, 
fraud prevention, risk management, employment reporting, tenant screening and 
collection services. 

Consumer reporting agencies are careful stewards of personal information and 
they adhere to strict procedures outlined in federal and state laws. 2 The information 
infrastructure of the consumer reporting system is the backbone of the consumer 
credit economy. 3 

Our members have a strong interest in the legitimate and lawful use of all infor- 
mation, including Social Security numbers. Used properly, SSNs play a substantial 
role in reducing fraud, enhancing workplace security, promoting public safety, sup- 


1 Preventing Identity Theft by Terrorists: Hearing before the House Comm, on Financial Serv- 
ices Subcomm. on Oversight and Investigations and the House Comm, on Ways and Means 
Subcomm. on Social Security, 107 th Cong. (Nov. 8, 2001) (testimony of Stuart K. Pratt, Vice 
President, Vice President, Associated Credit Bureaus); Use and Misuse of Social Security Num- 
bers: Hearing before the House Comm, on Ways and Means Subcomm. on Social Security, 106 th 
Cong. (May 11, 2000) (testimony of Stuart K. Pratt, Vice President, Vice President, Associated 
Credit Bureaus). 

2 All consumer reporting agencies are bound by the Fair Credit Reporting Act (FCRA), 15 
U.S.C. § 1681 et seq. and numerous state credit reporting laws. Among other things, the FCRA 
requires consumer reporting agencies to maintain reasonable procedures to assure maximum 
possible accuracy, 15 U.S.C. § 1681e(b) and prohibits data furnishers from furnishing data to 
consumer reporting agencies if they know the information has an error, § 1681s— 2(a). In addi- 
tion, a consumer reporting agency is prohibited from furnishing a consumer report to anyone 
without a “permissible purpose” — a narrow and statutorily limited list of permitted uses. 
§ 1681b. 

3 For example, it was recently noted that 

Maintaining a reliable and robust national credit reporting system is essential to ensure the 
continued availability of consumer credit at reasonable costs * * * The ready availability 
of accurate, up-to-date credit information from consumer reporting agencies benefits both 
creditors and consumers. Information from consumer reports gives creditors the ability to 
make credit decisions quickly and in a fair, safe and sound, and cost-effective manner. Con- 
sumers benefit from access to credit information from different sources, vigorous competi- 
tion among creditors, quick decisions on credit applications, and reasonable costs for credit. 

Fair Credit Reporting Act: How it Functions for Consumers and the Economy: Hearing before 
the House Comm, on Financial Services Subcomm. on Financial Institutions and Consumer 
Credit, 108 th Cong. (June 4, 2003) (statement of Dolores S. Smith, Director, Division of Con- 
sumer and Community Affairs, Board of Governors of the Federal Reserve System). 
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porting homeland defense, reducing state and federal entitlement fraud, enhancing 
child support enforcement, and facilitating commerce to a diverse, mobile electronic 
society. 

Before I specifically address how the SSN is used by our industry and the impor- 
tance of this number, I have found it helpful to provide a short review of what a 
consumer reporting agency is, what is contained in a consumer report, and the law 
that governs our industry. 

CONSUMER REPORTING AGENCIES AND CONSUMER REPORTS 

Consumer reporting agencies maintain information on individual consumer pay- 
ment patterns associated with various types of credit obligations on approximately 
190 million Americans. The data compiled by these agencies is used by creditors and 
others permitted under the strict prescriptions of the FCRA. 

Consumer credit histories are derived from, among other sources, the voluntary 
provision of information about consumer payments on various types of credit ac- 
counts or other debts from thousands of data furnishers such as credit grantors, stu- 
dent loan guarantee and child support enforcement agencies. A consumer’s file may 
also include public record items such as a bankruptcy filing, judgment or lien. Note 
that these types of data sources often contain SSNs, as well. 

For purposes of data accuracy and proper identification, generally our members 
maintain information such as a consumer’s full name, current and previous address- 
es, Social Security Number (when voluntarily provided by consumers) and places of 
employment. This data is loaded into the system on a regular basis to ensure the 
completeness and accuracy of data. 4 

It is interesting to note that the vast majority of data in our members’ systems 
simply confirms what most of you would expect; that consumers pay their bills on 
time and are responsible, good credit risks. This contrasts with the majority of sys- 
tems maintained in other countries, such as Japan or Italy, which store only nega- 
tive data and do not give consumers recognition for the responsible management of 
their finances. 

As important as knowing what we have in our files is also knowing what types 
of information our members do not maintain in files used to produce consumer re- 
ports. Our members do not know what consumers have purchased using credit (e.g., 
a refrigerator, clothing, etc.) or where they used a particular bank card (e.g., which 
stores a consumer frequents). They also don’t have a record of when consumers have 
been declined for credit or another benefit based on the use of a consumer report. 
Medical treatment data isn’t a part of the databases and no bank account informa- 
tion is available in a consumer report. 

THE FAIR CREDIT REPORTING ACT (FCRA) 

In addition to our general discussion of the industry, we believe it is important 
for your Subcommittee to have a baseline understanding of the law which regulates 
our industry. 

Enacted in 1970, the Fair Credit Reporting Act was significantly amended in the 
104th Congress with the passage of the Credit Reporting Reform Act. 

Congress, our Association’s members, creditors and consumer groups spent over 
six years working through the modernization of what was the first privacy law en- 
acted in this country (1970). This amendatory process resulted in a complete, cur- 
rent and forwarding-looking statute. The FCRA serves as an example of successfully 
balancing the rights of the individual with the economic benefits of maintaining a 
competitive consumer reporting system so necessary to a market-oriented economy. 

The FCRA is an effective privacy statute, which protects the consumer by nar- 
rowly limiting the appropriate uses of a consumer report (often we call this a credit 
report) under Section 604 (15 U.S.C. 1681b), entitled “Permissible Purposes of Re- 
ports.” 

Some of the more common uses of a consumer’s file are in the issuance of credit, 
subsequent account review and collection processes. Reports are also, for example, 
permitted to be used by child support enforcement agencies when establishing levels 
of support. 

Beyond protecting the privacy of the information contained in consumer reports, 
the FCRA also provides consumers with certain rights such as the right of access; 
the right to dispute any inaccurate information and have it corrected or removed; 


4 Note that there are in fact a number of major credit reporting systems in this country. With- 
in CDIA’s membership the three most often recognized systems would be Equifax, Atlanta, 
Georgia; Experian, Costa Mesa, California; and TransUnion, Chicago, Illinois. These systems not 
only manage their own data, but provide data processing services for the hundreds of local inde- 
pendently-owned automated credit bureaus in the Association’s membership. 
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and the right to prosecute any person who accesses their information for an imper- 
missible purpose. The law also includes a shared liability for data accuracy between 
consumer reporting agencies and furnishers of information to the system. 

SOCIAL SECURITY NUMBER USES 

Let me now turn to the question of how our industry uses the SSN. 

Under the Fair Credit Reporting Act, our industry has a duty to “. . . employ rea- 
sonable procedures to ensure the maximum possible accuracy . . .” of the consumer 
report. Further, we must design systems that accurately allow our customers to ex- 
tract only the data requested on a specific individual. 

We must accomplish this dual mission of accuracy both in terms of building data- 
bases, but also properly identifying files in our systems in the context of a highly 
mobile society. Consider the following: 

• Approximately 16% of the nation’s population moves each year according to the 
U.S. Census Bureau, which means many addresses change each year. (This 
equates to approximately 42 million Americans) 

• Based on National Center for Health Statistics, it is estimated that there are 
2.4 million marriages and 1.2 million divorces annually. This event frequently 
triggers changes in addresses as well as last names. 

• In 1998 there were 6 million homes in the U.S. that are considered vacation 
or second homes. Consumers often switch billing addresses if they stay at such 
residences for long periods of time and in some cases maintain billing addresses 
for both residences with various creditors. (Source: U.S. Census Bureau House 
Vacancy Survey as extrapolated by the National Association of Realtors) 

These data clearly speak to the challenge our members face where identifying 
data often changes. 

In light of the mobility of our society, the Social Security Number plays a very 
significant role in ensuring data quality. Our members process 2 billion data ele- 
ments a month. These elements are a combination of credit history data and identi- 
fying information. Consider the following very real example. 

Where a consumer has changed a last name due to marriage or divorce and has 
moved to a new address, which is common in either case, the SSN is the most stable 
identifying element in the file. First, it helps us to identify the consumer’s file with 
precision during this life transition where he or she is likely applying for new credit, 
seeking approval for utilities, and seeking to rent or purchase a new residence. The 
consumer expects that the consumer report will be available for all of these nec- 
essary transactions and the SSN helps our members to meet this expectation. Sec- 
ond, the consumer expect his or her file to be accurate and the SSN helps us to 
maintain the file accurately even when the consumer is in the midst of updating 
creditors with changes in name and address. 

The SSN is also a critical element in producing information products, which are 
commonly called locator services. These services are made available, for example, 
to child support enforcement agencies for purposes of locating non-custodial par- 
ents; 5 to pension funds which must locate beneficiaries; to law enforcement for locat- 
ing criminals or witnesses; 6 to healthcare providers that must locate individuals 
who have chosen not to pay their bills, to state benefits agencies to reduce public 
assistance fraud, 7 and for other similar uses. 


5 The U.S. Department of Health and Human Services noted that “[rjoutine transfer of child 
support payment information to credit bureaus ... is essential because these obligations may 
constitute a superior lean on a creditor’s income.” A Guide About Child Support Enforcement 
for Credit Grantors , U.S. Department of Health and Human Services, Family Support Adminis- 
tration. November 1988. In addition The Association for Children for Enforcement of Support 
reports that public record information provided through commercial vendors helped locate over 
75 percent of the “deadbeat parents” they sought. Information Privacy Act, Hearings before the 
Comm, on Banking and Financial Services, House of Representatives, 105th Cong., 2d Sess. (July 
28, 1998) (statemen t of Robert Glass). 

6 Then-FBI Director Louis Freeh testified before Congress in 1999 and noted that in 1998, his 
agency made more than 53,000 inquiries to commercial on-line databases “to obtain public 
source information regarding individuals, businesses, and organizations that are subjects of in- 
vestigations.” This information, according to Director Freeh, “assisted in the arrests of 393 fugi- 
tives, the identification of more than $37 million in seizable assets, the locating of 1,966 individ- 
uals wanted by law enforcement, and the locating of 3,209 witnesses wanted for questioning.” 
Hearing before the Senate Comm, on Appropriations Subcomm. for the Departments of Com- 
merce, Justice, and State, and the Judiciary and Related Agencies, March 24, 1999 (Statement 
of Louis J. Freeh, Director of the Federal Bureau of Investiga tion). 

7 Consider the following examples: 


Continued 
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Further, the SSN plays a role in fraud prevention products. Where a consumer 
makes application for a product or service, information products that help the busi- 
ness to ensure that they are doing business with the right consumer use information 
products to authenticate or verify the application information. This is true in both 
for bricks-and-mortar business and in e-Commerce. 

If applicant data does not match, then the business can take additional steps to 
verify the consumer’s identity and thus prevent fraud. 

FRAUD PREVENTION AND IDENTITY THEFT 

In your press release announcing this hearing, you mention the potential for mis- 
use of the SSN. Our industry has a history of bringing forward initiatives to address 
fraud. These efforts focus on the use of new technologies, and better procedures and 
education. CDIA and its members have a long history of being leading innovators 
of identity fraud solutions. The attachment provides a short thumbnail of our in- 
volvement in identity fraud remediation since 1993. 8 

CONCLUSION 

In conclusion, you can see by our actions that in large part our uses of the SSN 
are governed under the Fair Credit Reporting Act, one of the most extensive privacy 
laws in the country. Beyond law, our members have a history of proactively limiting 
how SSNs are used outside of the FCRA. No one particular element of information 
is the key to identity theft. The underlying theme in all of this is balance. 

Laws that overreach in attempting to limit use of the SSN are likely to merely 
take fraud prevention tools out of the hands of legitimate businesses at the expense 
of consumers. Ironically, to prevent fraud you must be able to crosscheck informa- 
tion. To maintain accurate databases, you must be able to maintain a range of iden- 
tifying elements. Absent the availability of the SSN, we will be less able to build 
accurate data bases, to accurately identify records and to help prevent the very 
crime through the development of fraud prevention and authentication tools. 


• “Individuals confined to a correction facility for at least 1 full month are ineligible to con- 
tinue receiving federal Supplemental Security Insurance (SSI) program benefits. . . . Be- 
tween January and August 1996, the sharing of prisoner data between SSA and state and 
local correction facilities helped SSA identify about $151 million overpayments already 
made and prevented about $173 million in additional overpayments to ineligible prisoners.” 
General Accounting Office, Social Security Numbers: Government Benefits from SSN Use but 
Could Provide Better Safeguards, GAO-02-352 (May 2002), 15, citing General Accounting 
Office, Supplemental Security Income: Incentive Payments Have Reduced Benefit Overpay- 
ments to Prisoners, GAO / HEHS-00-02 (Nov. 22, 1999). 

• “Applicants for Temporary Assistance for Needy Families (TANF), a program designed to 
help low-income families, are required to provide their SSNs. Some agencies share SSN in- 
formation to verify eligibility and identity. Between January and September 1999, New 
York State estimated that SSN verification saved about $72 million.” General Accounting 
Office, Social Security Numbers, Government Benefits from SSN Use but Could Provide Bet- 
ter Safeguards, GAO-02-352 (May 2002), 15, citing General Accounting Office, Benefit and 
Loan Programs: Improved Data Sharing Could Enhance Program Integrity, GAO-HEHS-OO- 
119 (Sept. 13, 2000). 

• “The Department of Education uses SSNs to match data on defaulted education loans with 
the National Directory of New Hires (NDNH). ... As a result of this matching . . . the de- 
partment reported collecting $130 million from defaulted student loan borrowers in 2001.” 
General Accounting Office, Social Security Numbers, Government Benefits from SSN Use but 
Could Provide Better Safeguards, GAO-02-352 (May 2002), 16. 

• Federal agencies that are owned money share that information with the Treasury Depart- 
ment which matches the debtors’ SSNs with those taxpayers that are owed tax refunds and 
reduces the refund by the amount owed. In 2001, the Treasury Department offset tax re- 
funds by $1 billion. Id. 

8 While we agree that identity fraud is a significant problem, we also hope the committee will 
consider any legislation in the context of the most accurate and reliable data on the scope of 
the problem. One witness has suggested that the number of identity fraud victims could be be- 
tween 700,000-1.8 million per year. Misuse of Social Security Numbers: Hearing before the 
House Comm, on Ways and Means Subcomm. on Social Security, 108 th Cong. (July 10, 2003) 
(statement of Steve Edwards, Special Agent in Charge, Financial Investigations Unit, Georgia 
Bureau of Investigations; State Coordinator, U.S. Department of the Treasury, Financial Crimes 
Enforcement Network; and Vice Chairman of the Board of Directors, National White Collar 
Crime Center). CDIA feels that the best review of the level of identity fraud victimization is 
closer to 60,000 to 92,000 per year, General Accounting Office, Identity Theft: Prevalence and 
Cost Appear to be Growing, GAO-02-363 (March 2002), 4, or 162,000 per year. FTC Reports: 
Figures and Trends on Identity Theft, January 2002-December 2002. The GAO figures were de- 
veloped based on interviews with three national consumer reporting agencies. Consumer report- 
ing agencies are probably the best source understanding the scope of identity fraud victimization 
as victims are mostly likely to contact consumer reporting agencies as a first response. 
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Thank you for this opportunity to offer testimony. CDIA is available to assist your 
and your committee at any time. 


Consumer Reporting Agency Responses to Identity Fraud 

• 1993. Consumer Data Industry Association, then known as Associated Credit 
Bureaus, formed a Fraud and Security Task Force. 

• 1998. Creation of True Name Fraud Task Force led by former Vermont Attorney 
General M. Jerome Diamond. The work of the task force included meetings with 
law enforcement, consumer organizations, privacy advocates, legislators and 
staff, victims, and others. 

• The capstone of the True Name Fraud Task Force was a series of initiatives 
announced in March 2000. These initiatives meant the consumer reporting in- 
dustry was the first industry to step forward and not only educate its members 
about the problems consumers experienced, but to seek specific changes in busi- 
ness practices. The initiatives are to: 

• Advocate the use and improve the effectiveness of security alerts through the 
use of codes transmitted to creditors. These alerts and codes can help credi- 
tors avoid opening additional fraudulent accounts. 

• Implement victim-assistance best practices to provide a more uniform experi- 
ence for victims when working with personnel from multiple fraud units. 

• Assist identity theft victims by sending a notice to creditors and other report 
users when the victim does not recognize a recent inquiry on the victim’s file. 

• Execute a three-step uniform response for victims who call automated tele- 
phone systems: automatically adding security alerts to files, opting the victim 
out of prescreened credit offers, and sending a copy of his or her file within 
three business days. 

• Launch new software systems that will monitor the victim’s corrected file for 
3 months, notify the consumer of any activity, and provide fraud unit contact 
information. 

• Fund, through CDIA, the development of a series of consumer education ini- 
tiatives through CDIA to help consumers understand how to prevent identity 
theft and also what steps to take if they are victims. 

• 2001. CDIA announced a police report initiative so that when a police report 
is provided as part of the process of disputing fraudulent data, Equifax, 
Experian and TransUnion will block these disputed items from appearing on 
subsequent consumer reports regarding that individual. 

• “Another collaborative effort with tremendous promise is your new police re- 
port initiative. ... I appreciate that certain consumer-based initiatives require 
you to balance accuracy issues — knowing that the consumer’s report contains 
all relevant credit information, including derogatory reports — against cus- 
tomer service. From my perspective, your police report initiative strikes just 
the right balance.” J. Howard Beales, III, Director of the FTC’s Bureau of 
Consumer Protection, before the Consumer Data Industry Association. Jan. 17, 
2002. 

• 2002-03. ID Fraud Victim Data Exchange. CDIA and its members committed 
in 2002 to start a pilot test in early-2003 so that when an ID fraud victim calls 
any one of the participating credit reporting agencies, the victim will be notified 
that his or her identifying information will be shared by the receiving credit re- 
porting agency with the other two participating credit reporting agencies and 
that the following steps will be taken by each recipient of the victim’s informa- 
tion: 

• A temporary security alert will be added to the victim’s file. This security 
alert will be transmitted to all subsequent users (e.g., creditors) which re- 
quest a copy of the file for a permissible purpose under the Fair Credit Re- 
porting Act. 

• The victim will be opted out of all non-initiated offers of credit or insurance. 

• The CRA will ensure that a copy of the victim’s file is in the mail within three 
business days of the victim’s request. 

• Our efforts are paying off. 

• Most calls are prevention related. CDIA members report a majority of con- 
sumers who contact fraud units are taking preventative steps and are not re- 
porting a crime. 
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• Victims are learning of the fraud earlier. According to an FTC report in June 
2001, 42% of victims learn about the crime within 30 days or less, a full 10% 
less than in the prior report. CDIA estimates another 35% learn of the crime 
within one to six months and 7% learn of the crime in six months to a year. 

• Victimization of the elderly is dropping. In 2001, the FTC estimated that 6.3% 
of identity fraud victims were over 65, a 5% decrease from 2000. 

About CDIA 

Founded in 1906, the Consumer Data Industry Association (CDIA), formerly 
known as Associated Credit Bureaus (ACB), is the international trade association 
that represents more than 400 consumer data companies. CDIA members represent 
the nation’s leading institutions in credit reporting, mortgage reporting, check 
verification, fraud prevention, risk management, employment reporting, tenant 
screening and collection services. 

For more information about CDIA, its members, or identity fraud or other issues, 
please visit us at www.cdiaonline.org or contact us at 202-371-0910. 


Statement of the Honorable Darlene Hooley, a Representative in Congress 
from the State of Oregon 

Just last week this very committee heard testimony on the many problems caused 
by the misuse of Social Security numbers and the ever increasing problem of iden- 
tity theft. 

I have become increasingly concerned about the vast quantities of sensitive, per- 
sonal information that is now vulnerable to criminal interception and misuse. Cur- 
rently, the ease of obtaining the Social Security number of an individual is shocking. 
Numbers are sold, exchanged and printed with an alarming carelessness. With a So- 
cial Security number and a few pieces of other easily obtainable personal informa- 
tion, fraudulent accounts can be opened and lives can be ruined. Many individuals 
work their entire life to build a spotless credit record, only to have it destroyed by 
a criminal armed merely with a Social Security number. The protection of Social Se- 
curity numbers is a vital step to slowing the growth of identity theft and protecting 
people’s lives. 

I’ve been active in trying to prevent further horror stories of misused Social Secu- 
rity numbers. Two and a half years ago, a young boy in Salem named Tyler Bales 
lost his battle with a rare genetic disease called Hurler syndrome. As if it were not 
hard enough to lose your sixteen month old child, Tyler’s parents later learned — 
courtesy of the IRS — that someone was claiming Tyler as a dependent on their 2000 
income tax return. 

Because of disclosure issues, the IRS could not give out the identity of this thief 
to local law enforcement, even though ID theft is a felony offense in the state of 
Oregon. To date, two and one half years later, the Bales still do not know the iden- 
tity of this thief. 

For this reason, I request that the House Committee on Ways and Means consider 
the “ID Theft Loophole Closure Bill” as the committee seeks legislation to prevent 
the misuse of Social Security numbers. This legislation simply changes the law to 
allow the IRS to furnish the name, Social Security number and address of a sus- 
pected identity thief to state and local law enforcement agencies for the exclusive 
purpose of locating the individual. 

Identity theft is not a victimless crime. We must cut the red tape that is pre- 
venting thieves from being prosecuted for their crimes, and I believe this legislation 
is the right tool for the job. 


Statement of the Honorable Max Sandlin, a Representative in Congress 
from the State of Texas 

Thank you Mr. Chairman and Ranking Member Matsui, for the opportunity to 
testify today on the impact of the use and misuse of Social Security numbers. 

I am pleased that my colleagues on the Ways and Means committee have con- 
vened a hearing on how the growing use of Social Security numbers as a national 
identifier has resulted in the mounting problem of identity theft. As you know, while 
our Social Security numbers were expressly created to catalogue workers’ earnings 
for benefit purposes, nearly every branch of our society has co-opted Social Security 
numbers as an identification method. Our Social Security numbers can be found on 
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records kept by schools, banks, businesses, and many states even list them on peo- 
ple’s drivers licenses. 

While the use of Social Security numbers is very convenient and facilitates com- 
merce through easy credit checks, we need to be cognizant of how the over exposure 
of Social Security numbers also easily enables criminals to commit identity theft. 
Simply by stealing an individual’s purse, a thief may have immediate access to an 
individual’s name and social security number and use that information to open new 
credit cards, establish new bank accounts, and even initiate new cell phone service, 
all to ring up charges that their victims will be left to contest. In the mean time, 
innocent, hard working, victims may find their credit destroyed, and may not even 
know about the theft until they are turned down for a mortgage or car loan. Once 
this occurs they are then forced to embark on an arduous process to restore their 
financial standing, while their dreams for a new home or needed vehicle remain on 
hold. 

The Federal Trade Commission noted that identity theft has increased over 88% 
just in the last year, with nationwide complaints totaling 162,000. In my home 
state, over 14,000 Texans filed victim complaint statements last year with the Fed- 
eral Trade Commission. Their tragic experiences provided the impetus for our state 
legislature’s enactment of a law to combat identity theft last month. While we were 
only the second state in the nation to do so, seven other states are actively consid- 
ering similar legislation. 

We must continue to find ways to protect the citizens of this country from fraud 
and abuse caused by criminals committing identity theft. The Social Security Ad- 
ministration, credit bureaus, businesses, individuals and other federal, state and 
local government agencies must all coordinate resources to offer a comprehensive 
plan of action and protection. On the federal level, I am pleased to be a co-sponsor 
of H.R. 2035. This bill requires consumer reporting agencies to provide free credit 
reports annually upon the request of a consumer, as well as require the truncation 
of credit card numbers on printed receipts. By enacting common sense legislation 
like this, individuals will be able to detect identity theft at an early stage, before 
their credit reports are permanently damaged. 

Congress has a responsibility to help the American people, and our National econ- 
omy, prosper. Strengthening financial privacy laws and protecting Social Security 
numbers will help to achieve these goals. Thank you for your time. 
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